Gcore phishing kit
Gcore is the name public research uses for browser-gated OAuth pages that submit a Turnstile response with an authorization-code request. We have matched it on 166 sites since 4 August.
Gcore in numbers
Since 4 August, the first Gcore match in our records, counted on 12 November 2026. How we count.
| Sites with Gcore code | 166 |
|---|---|
| Sites with a match in the last 30 days | 68 |
| New sites in October | 91 |
| Sites captured since 25 September | 94 |
A browser test controls the redirect
Gcore is the name this page family goes by in public research, not the Gcore cloud company. One component screens the browser before calling window.location.replace with its destination.
The script checks navigator.webdriver, PhantomJS and Nightmare globals, plus user-agent terms associated with headless browsers, command-line clients, scanners and link previews. It also tests WebGL, reported languages, the expected Chrome object and the battery API. The redirect runs after those checks pass.
Turnstile submits the OAuth request
The captured page is a compact interstitial titled "One more step...". It places Cloudflare Turnstile above a form whose action is an /oauth/authorize URL.
When Turnstile succeeds, the callback removes any earlier response field, inserts the current token and submits the form immediately. Widget errors are posted to /captcha-widget-error as an event value.
The authorization request uses response_type=code, an HTTPS callback and scopes named channels:read and chat:write. Those scopes request access to list channels and post chat messages. The client ID, callback, state, Turnstile site key and random query value can change between deployments.
Pages from 1 September and 9 October kept the same HTML structure and callback logic while their OAuth and Turnstile values changed.
What we see
| Month | New sites |
|---|---|
| September | 49 |
| October | 91 |
| November so far | 0 |
Among successful captures since 25 September, 0 of 94 Gcore sites ran WordPress.
Checking a Gcore page
Preserve the initial response and the form action. Look for:
- checks for WebDriver, PhantomJS, Nightmare, crawler names or missing browser features
window.location.replaceafter the browser tests- a Turnstile callback that creates a response input and submits immediately
- an
/oauth/authorizeaction withresponse_type=code channels:readandchat:writein the requested scope- error reports posted to
/captcha-widget-error
Remove the gate and consent page. Revoke the application registration and review the hosting and deployment accounts that created them.