MassCollect phishing kit
MassCollect is a set of generated login pages that send each login to a same-origin collector and then force another attempt. We have matched it on 4,888 sites since 2 October.
MassCollect in numbers
Since 2 October, the first MassCollect match in our records, counted on 12 November 2026. How we count.
| Sites with MassCollect code | 4,888 |
|---|---|
| Sites with a match in the last 30 days | 1,311 |
| New sites in November so far | 285 |
| Sites captured since 25 September | 2,263 |
A generated batch with one collection path
MassCollect uses self-contained login templates deployed as complete HTML pages. Their titles and labels pose as file exchanges, remote-access gateways, monitoring dashboards and support consoles. The form, styling and collection code arrive together in one response.
Both templates send the entered identity and password to /api/v1/authenticate on the page's own host.
The file portal ignores every answer
The first template presents a compact file or remote-access login. Its fields use the short names u and p. Before submission, the script makes a fingerprint by Base64-encoding the browser's user agent with the current time and places it in a hidden field.
The form is sent as multipart data after a short randomized delay. The script discards the server's response, advances through connection and verification messages, then displays an invalid-password error. It clears the password and returns the cursor to that field.
The console template reads status codes
The second template looks like an edge, cache or administration console. It generates element IDs when the page loads and sends JSON containing identity, credential, csrf_token and client_timestamp.
Responses with status 400, 401 or 403 can supply the error shown to the visitor. Other failures become a gateway, timeout or invalid-credentials message. Every branch ends at the same form with an empty password field, ready to collect another attempt.
What we see
| Month | New sites |
|---|---|
| September | 0 |
| October | 4,603 |
| November so far | 285 |
Among successful captures since 25 September, 0 of 2,263 MassCollect sites ran WordPress.
Checking a MassCollect page
Open the reported path with test values and preserve the response body and network log. Look for:
- a POST to
/api/v1/authenticateon the page's own host - multipart fields named
u,pandfingerprint - a fingerprint built from
navigator.userAgentandDate.now() - a JSON request containing
identity,credential,csrf_tokenandclient_timestamp - generated element IDs or a randomized delay immediately before submission
- code that shows an error, clears the password and focuses the field after every result
Remove the page and its same-origin handler. Review the hosting and deployment accounts and rotate their credentials.