The urlscan Threat Research Team identified a phishing site impersonating Prove, an identity verification provider, which stood out due to the notable nature of the company being targeted. A single distinctive JavaScript global variable present on the page provided an effective starting point for clustering, ultimately revealing a shared phishing framework used against a range of smaller and lesser-known financial sector brands.
This brief documents the initial discovery, the pivots used to expand the cluster, and the resulting victimology, which shows a clear preference for targeting financial services companies that receive comparatively little public attention.
CY-Kit represents a dangerous evolution in phishing, moving beyond simple credential harvesting to a “live puppeteer” model where operators control victim sessions in real time via Socket.IO. This Chinese-backed framework features an invasive toolset that includes live social-engineering chat, the ability to silently capture victim photos via webcam, and dynamic “HackerInput” monitoring to observe every keystroke.
Read our full analysis of CY-Kit’s modular architecture and how its real-time command-and-control interface allows attackers to manipulate banking verification flows as they happen.
Oriental Gudgeon, also known as CoGUI, has undergone a major architectural shift toward a centralized encrypted wrapper model to mask its global phishing operations. This latest iteration employs defensive anti-analysis techniques, such as randomized local storage artifacts and encrypted API routing, while maintaining a heavy focus on US government entities and APAC financial institutions.
Read our full technical breakdown to see how this mature framework uses multi-stage workflows, from OTP verification to localized UI mapping, to compromise users across the telecommunications, logistics, and retail sectors.
The Darcula phishing framework continues to evolve, transitioning from early API-driven roots to a sophisticated “Phishing-as-a-Service” model using encrypted WebSockets and wrapper APIs. Our latest research uncovers the inner workings of Darcula, its expansion into fake e-commerce storefronts via the “NewBee” and “PandaShop” ecosystems, and its persistent targeting of government and financial institutions worldwide.
Discover how this Chinese-backed operation maintains a global footprint through advanced domain rotation and localized social engineering lures.
The Sailor Framework has emerged as a highly specialized Chinese-backed phishing ecosystem, moving away from broad industry attacks to dominate a specific vertical: U.S. state government and tolling infrastructure. By utilizing AES-encrypted WebSockets and modular “branches” like Sailors and globalConfig, the platform evades traditional detection while harvesting sensitive payment and identity data through urgency-based lures.
Deep-dive into our analysis of this modular architecture and learn why browser storage keys, rather than URLs, have become the new frontline for tracking these sophisticated campaigns.
Phishing campaigns that impersonate a single brand are often assumed to come from a single source, but that assumption rarely holds up. Calendly is a widely used scheduling platform for booking meetings and interviews, making it a highly believable lure in phishing campaigns.
Calendly-themed phishing shows how one trusted workflow can be abused by multiple, unrelated phishing kits at the same time. While the pages may look similar, the underlying infrastructure and tooling often differ significantly.
Over the past several months, the urlscan Threat Research Team has conducted extensive research to identify, cluster, and track some of the most impactful Chinese-language phishing-as-a-service (PhaaS) ecosystems operating at a global scale. This research combines large-scale telemetry, infrastructure analysis, and campaign tracking to better understand how these services are structured, operated, and deployed.
Beginning May 4th, we will publish a series of linked Threat Intelligence reports focused on the most prominent Chinese-language phishing frameworks currently active. Each report will examine a specific framework or activity cluster, providing detailed insights into campaign scale, infrastructure design, operational workflows, tracking mechanisms, and the detection methodologies developed by the urlscan.io team.
Collectively, this series aims to provide a comprehensive view of the ecosystems underpinning a significant portion of global phishing activity today, with a particular focus on the services enabling large-scale, cross-border campaigns.
During routine monitoring of malicious web activity on the urlscan platform, the urlscan Threat Research Team identified a phishing campaign abusing the Ultraviolet (UV) client-side proxy framework. This framework was being leveraged to obscure attacker infrastructure, evade traditional detection methods, and deliver high-fidelity credential harvesting content.
We are excited to be heading to PIVOTcon, where we will host a hands-on
workshop focused on hunting phishing pages and infrastructure. If you are
attending the conference, this is a great opportunity to connect with us and
learn how to take make full use of our community and urlscan Pro platforms.
Workshop: Uncovering Phishing Infrastructure
A Hands-On Workshop with urlscan.io
In this interactive workshop, we will show how analysts can transform a single
suspicious URL into a deep investigation - uncovering entire phishing
campaigns and the infrastructure behind them. Whether you’re new to urlscan.io
or already using it in your workflow, this session is designed to give you
practical techniques you can apply immediately.
Over the last couple of years, the urlscan Threat Research Team have observed repeated, near-identical “live support” webpages used to socially-engineer victims into installing legitimate remote access tools (AnyDesk, ConnectWise/ScreenConnect, TeamViewer, etc.). Threat actors pair these pages with cold calls impersonating banks, telcos, or crypto services and attempt to install screen sharing software. Once connected they take control of sessions and facilitate fraudulent transfers.
