Phishing kits turn a link into a working login trap.

A phishing kit is the page code and operator service behind a fake sign-in, document portal or payment form. It can copy a familiar page, relay a real login as it happens or send the visitor to a genuine device sign-in that authorizes the operator's session.

email, message or QR code
  -> phishing host or compromised site
  -> CAPTCHA, fingerprint or proof-of-work gate
  -> fake form, relayed sign-in or device-code prompt
  -> credentials, MFA value, session cookie or OAuth token captured

Dedicated hosts dominate our captures

Phishing pages live in both places: domains and hosted projects set up for the campaign, and legitimate websites that somebody has compromised. Kali365 appears on hosted projects, object storage and attacker-controlled domains. Sneaky 2FA has appeared on compromised WordPress sites and attacker-controlled domains.

Our captures lean heavily toward standalone phishing infrastructure. Of the 10,500 phishing sites captured since 25 September, 54 ran WordPress and 2 requested Joomla core paths.

The page sits at the root, behind a long random path or under a hosted-project address. Some roots show a holding page while the phishing path stays active. TemplateHop displays a loading animation, then randomly picks a destination from an embedded URL pool. Its redirect reaches a fake Meta appeal page that collects passwords and authentication codes.

The gate decides who sees the page

A direct visit often stops at a CAPTCHA or a blank page. SamePath shows a fake Cloudflare checkbox, posts a page-supplied code to the current path and reloads the same URL to release the phishing page. TurnShade submits a Cloudflare Turnstile token with the original path before releasing a counterfeit Microsoft sharing page.

Browser checks run alongside these challenges. Kali365 scores browser properties, window dimensions and mouse, touch or scroll activity before it submits the visitor to the next path or opens a decoy. Gcore checks automation flags, crawler names, WebGL, browser languages and battery support. Sneaky 2FA variants make the browser solve a proof-of-work challenge or an image puzzle before serving the Microsoft sign-in page. ShieldCrypt covers an encrypted form with a spinner and waits for browser interaction before rendering it.

Some gates stack. A Hebrew page that claims to verify access before opening a shared file runs webdriver, timing and proof-of-work checks whose results only change its status text. Behind it, a cloaker shows filtered visitors a decoy company page, and everyone else gets an "Email Identity Check" page whose Open Document button builds a per-session path to a Microsoft and Adobe sign-in lure. A session without a token goes through href.li to Microsoft's real support site, so an analyst who follows the link lands somewhere legitimate.

Some kits keep the destination outside the page. A fake Adobe "Secured Remote Attachment" viewer on Vercel clicks its own View All button after a few seconds and redirects to a URL read from a public Firebase Realtime Database path, so the operator can change the target without touching the page. A FingerprintJS gate logs each visit to logger.php, turns away bots and VPN users and sends the rest to a Coinbase sign-in clone.

Test the exact link from the message. Visiting the hostname alone can show a different page.

Credentials are one kind of capture

MassCollect takes a username and password, displays an error and clears the password field for another attempt. Legokit builds the page around the email address in the link, sends repeated password attempts to Telegram or a PHP handler, then redirects to the real domain. PassTwice uses Meta verification and appeal lures to collect business identity, then repeats password and MFA prompts with scripted rejection messages. An Instagram clone labels its Web3Forms submissions "Training Simulation" and sends the real email and password to the operator.

The collection extends to payment details and recordings. Miarroba page chains add phone numbers, card details, camera frames and verification codes to the same victim record. PostalScam streams input over a token-bound WebSocket while an operator selects card errors, code requests and app-approval prompts. NexoSiren requests location, camera and microphone access behind document, message and account lures and sends the recordings to Telegram. Bluenoroff uses fake meeting pages to report visitor details and upload camera screenshots while an invitation form collects email passwords.

Document and meeting lures push downloads too. CSuite's fake Adobe document page reports each visit to Telegram and starts an installer download. Bluenoroff's Zoom-branded pages request a download URL from process.php or animate update progress before starting a Dropbox download through a hidden iframe.

Operators also steer bank pages by hand. A Bancolombia page signs its messages over a WebSocket while an operator moves the victim between login and code screens, and a PKO iPKO Biznes page reports which screen the victim is on and opens the screen the operator picks. A Desjardins AccesD page sits behind Interac e-Transfer lures and puts a reCAPTCHA in front of its login form. A fake Phantom wallet page looks up its collection server in a DNS TXT record over HTTPS before posting the recovery phrase.

Some pages read the card itself. A Santander "card demagnetisation" page runs inside a malicious Android app and uses the app's NFC bridge to read the victim's contactless card. It relays the card's APDU commands and the PIN over a raw TCP connection to 194.36.85[.]76 on port 8888, where the operator's payment terminal waits for them. Its version string, 20251101-santander-es, marks one build per bank.

Adversary-in-the-middle kits relay the login while it happens. FlowerStorm and Sneaky 2FA send the credentials and MFA response to the real service through their backend, then keep the authenticated session returned by that service. NakedPages takes a browser-in-the-middle approach: it streams a live login DOM into the page and sends typed, pasted and selected input back over Socket.IO. Bluekit does the same behind a fake human check, replaying the attacker's browser with rrweb over an encrypted WebSocket.

Device-code kits avoid a copied password form. Kali365, EvilTokens and N0va give the visitor a short code and send them to Microsoft's real device sign-in. The credentials and MFA prompt belong to Microsoft, but the code authorizes the session started by the kit. Gcore uses another route, asking the visitor to approve OAuth scopes for an application.

What we see across phishing sites

Month	New sites
September	4,638
October	9,974
November so far	2,761

Checking a site

Open the exact reported path in a private browser with developer tools recording the page and network log. Use test values only. Check for:

• a root page that changes when the original long path is used
• Turnstile, a home-made CAPTCHA, an image puzzle or repeated browser-fingerprint requests before the form appears
• a loading animation that randomly redirects from an embedded URL pool
• forms that post credentials, card details or codes to the same host, Telegram, Discord or an unfamiliar endpoint
• Socket.IO or WebSocket traffic while values are typed
• a meeting page that uploads camera screenshots or starts a download presented as an update
• a device code copied to the clipboard and a link to a genuine Microsoft sign-in
• an OAuth consent form whose redirect address or requested scopes do not belong to the application
• scripts, PHP files, WordPress plugins or hosted-project deployments absent from the site's release

Remove the page and every gate or loader in front of it. Review DNS, hosting, CMS and deployment access, rotate the credentials that could have placed the files, clear caches and test the original path again.