A Chinese open-source development framework called Uni-App has become the backbone of a massive global scam ecosystem, with more than 236,000 second-level domains now running investment fraud templates built on it, according to Infoblox.
Uni-App, made by DCloud, lets developers write Vue.js code once and deploy it as mobile apps and websites simultaneously. It’s widely used in China for legitimate products. But threat actors have turned it into a scam factory.
The scam sites span fake cryptocurrency exchanges, gambling platforms, brand impersonation pages, WhatsApp phishing operations, and multi-language pig-butchering schemes. One notorious example: RainbowEx, a fake crypto platform that fooled thousands of residents in a small Argentine town.
Infoblox says the infrastructure has been growing since mid-2022, with a sharp spike after the RainbowEx scandal hit headlines in October 2024. At peak, roughly 15,000 new scam sites were appearing every month.
“Beyond the technical connections, we also uncovered patterns in the growth of the DCloud investment sites, along with coordinated dips in new domain registrations across scam websites on diverse hosts,” Infoblox noted. That pattern suggests a centralized operator making coordinated changes across the entire network.
Among the more elaborate operations: Lightning Shared Scooter Co., which likely caused millions in U.S. losses by promising passive income from a high-tech scooter-sharing venture, complete with physical storefronts. A similar operation, Yuechi Sharing Technology, is currently active in Australia, New Zealand, and the U.S.
DCloud itself does not appear to be involved in the fraudulent use. But the scale of the ecosystem — possibly run by dozens or hundreds of unrelated operators — makes it a persistent and growing threat.
