Miarroba phishing kit
Miarroba groups several Spanish-language phishing page chains found on the same free-hosting service. We have matched their distinct code patterns on 57 sites since 10 August.
Miarroba in numbers
Since 10 August, the first Miarroba match in our records, counted on 12 November 2026. How we count.
| Sites with Miarroba code | 57 |
|---|---|
| Sites with a match in the last 30 days | 14 |
| New sites in October | 15 |
| Sites captured since 25 September | 23 |
Spanish phishing pages on free hosting
Miarroba groups distinct Spanish-language phishing implementations found on one free-hosting service. The hosting provider inserts its own advertising and visitor-counter code into these pages. The implementations include Microsoft account pages, bank forms and a longer chain that updates one Discord message throughout the visit.
One Discord record grows across three stages
The longest captured chain begins with a Spanish Microsoft sign-in. It stores the email and password in local storage, sends them to a Discord webhook with ?wait=true, then saves the returned message identifier as msg_id.
The next page describes a facial check. It requests the camera, draws two frames to a canvas and attaches them as foto1.png and foto2.png by updating the same Discord message. A payment page follows. It saves the cardholder, card number, expiry and CVV under keys beginning with tarjeta_, then updates that message again or creates a replacement if the identifier is missing. The last redirect opens the real Outlook inbox.
Recent pages use short local handoffs
Other captures stop after a much smaller step. One page presents a Spanish Microsoft terms notice and moves the visitor to a local index05 page. Another accepts only Hotmail, Outlook, Live and MSN addresses, encodes the email and passes it to index2. A bank-themed page asks the visitor to select a loan amount, then hands that choice to the next local page.
A separate Microsoft collector calls a visitor-location service, combines the returned IP, city and country with the submitted credentials, and sends the report through the Telegram Bot API with Axios.
What we see
| Month | New sites |
|---|---|
| September | 26 |
| October | 15 |
| November so far | 3 |
We captured 23 Miarroba sites since 25 September. 0 of them were running WordPress. Of the 2 site recaptured after at least 25 days, 1 still matched.
Separating the branches in a site copy
Save every local page. On the short-handoff branches, the first form reveals only the next filename. For the Discord chain, search for msg_id, ?wait=true, PATCH requests, camera canvas exports named foto1.png and foto2.png, and local-storage keys beginning with tarjeta_. For the shorter branches, follow index2, index05 and other local form actions.