A new wave of “pig butchering-as-a-service” (PBaaS) operations is fueling large-scale romance and investment frauds across Asia, transforming cyber scams into a low-cost industrial economy.
Recent investigations spotlight two major providers, “Penguin” and “UWORK,” at the center of this growing underground marketplace.
The actor Penguin markets full-service fraud “kits” that include stolen personally identifiable information (PII), pre-registered SIM cards, social media accounts, and identity “character sets” (stolen profile photos).
Operating openly on Chinese language forums, Penguin also sells stolen credentials from Western social media and developer platforms, such as WhatsApp, Tinder, and Apple.
Its catalog extends to SCRM (social customer relationship management) tools, payment rails, and app distribution services used by organized scam networks.
Meanwhile, UWORK operates as a scam CRM and management platform powering fake investment and trading sites, including lion-forex[.]com.
The package offers admin dashboards, agent-management modules, and KYC (Know Your Customer) collection interfaces to add a layer of legitimacy.
Analysts found the same platform integrated with MetaTrader, Android, and iOS app sideloading systems, and nominee company registration services to disguise operations and funnel stolen funds.
These services together form a fully commoditized PBaaS ecosystem, where turnkey scam websites can be launched for under US$2,500, dramatically reducing barriers for transnational crime groups, as reported by Hendryadrian.
Some even sell preconfigured website templates for as low as US$50. By industrializing fraud through shared infrastructure, PBaaS actors can scale campaigns targeting victims worldwide with minimal technical expertise.
Experts warn that disrupting these criminal supply chains rather than chasing individual scammers must become a defensive priority.
Indicators of Compromise (IOC)
- uworkcrm[.]com -CRM domain linked to multiple sha zhu pan (pig butchering) scam sites
- lion-forex[.]com – Fake investment site tied to the UWORK platform
- .mobileprovision – iOS provisioning files for scam app installation
- .apk – Android binaries for distributing PBaaS-linked scam apps
- Bochuang Telegram channel – Payment and mule recruitment hub
- Telegram sellers – Advertising PBaaS CRM kits and fraud templates
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyber Press as a Preferred Source in Google.
