VaultToken phishing kit

One campaign slug selects the landing page

VaultToken is a hosted device-code lure reached through a phishing link. Its page builds two API addresses from an apiBase and a campaign slug. The first ends in /api/v1/landing-pages/public/<slug>/init; the second uses the same path ending in /poll. The slug selects the campaign-specific landing page.

The page identifies its presentation as docusign-sso. It resembles a DocuSign single-sign-on step and gives the visitor a short code instead of asking for account credentials.

The copy event starts the polling loop

On load, initDeviceCode() asks the backend for a device code and expiry time. The page displays the code and records code_copied when the visitor copies it. The visitor then opens the legitimate device sign-in page, enters the code and approves the request.

At the same time, pollToken(iv, expiresIn) repeatedly calls the campaign's poll address until the code expires or the backend returns a token. A successful response records token_captured.

What we see

Month	New sites
September	0
October	0
November so far	0

The latest VaultToken match was 26 August. The last 30 days contain 0 matches.

Checking a site for VaultToken

Open the exact link with developer tools recording requests. Look for:

• apiBase and slug combined into public landing-page API paths
• matching /init and /poll requests under the same campaign slug
• the docusign-sso template name
• initDeviceCode() followed by pollToken(iv, expiresIn)
• code_copied and token_captured event labels
• a displayed short code and a link to a legitimate device sign-in page

Remove the landing page and its campaign routes. Review the hosting account that published it, revoke the related identity sessions and rotate the site's deployment credentials.