Loading threat actor…
Robin Banks is a phishing-as-a-service (PhaaS) operation that provides ready-made phishing kits and related infrastructure to cybercriminal customers. Active since at least 2022, and possibly earlier in precursor form, it has been used primarily against customers of financial institutions and major online service providers, with observed targeting concentrated in the United States, United Kingdom, Canada, and Australia. The platform has offered impersonation templates for banks, telecommunications providers, and cloud and consumer internet brands, and has been used to steal banking information, account credentials, and authentication material. Robin Banks operates as a commercialized criminal service with subscription-based access, a management dashboard, customizable phishing templates, and centralized collection of stolen data. Its kits support delivery through SMS phishing and email phishing campaigns. The platform has included anti-analysis and defense-evasion features such as user-agent filtering, reCAPTCHA gating, traffic cloaking, and blacklist-based filtering to reduce exposure to scanners and automated detection systems. Researchers have also linked parts of its implementation to open-source and off-the-shelf tooling, including PHP obfuscation utilities, Adspect-style cloaking, and code derived from evilginx2. A notable capability associated with Robin Banks is adversary-in-the-middle cookie theft designed to bypass multi-factor authentication by capturing session cookies in addition to usernames and passwords. The service has advertised phishlets for major webmail and cloud identity providers, indicating utility beyond consumer banking fraud and into corporate account compromise and initial access. Stolen information has been accessible through a web interface and Telegram-based workflows, reflecting an operational model built for scale and ease of use by affiliates or customers. Following disruption of parts of its infrastructure, Robin Banks adapted by changing hosting arrangements, increasing operational security, and modifying kit features to improve resilience against takedowns. Reported changes included migration of infrastructure to a Russian hosting provider associated with permissive abuse handling, stronger access controls for customers, and greater use of private Telegram channels. Robin Banks is best characterized as a financially motivated cybercriminal service provider enabling phishing, credential theft, session hijacking, and downstream fraud or account compromise.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
8 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A phishing-as-a-service platform selling phishing kits to cybercriminals, primarily for credential and financial information theft, and adding cookie-stealing capability to bypass MFA via adversary-in-the-middle phishing.
Operates a phishing-as-a-service platform selling ready-made phishing kits used in large-scale SMS and email phishing campaigns to steal banking, financial, and account credentials, with possible use for initial access into corporate networks.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.