CoinBait
CoinBait is an AI-assisted phishing kit (tracked by Google Threat Intelligence Group in November 2025) designed for credential harvesting. It masquerades as a major cryptocurrency exchange to steal victims’ login details. Google’s analysis indicates CoinBait’s development was accelerated using AI code generation tools and that a sample was built using Lovable AI, implemented as a complex React website. The kit includes detailed/verbose analytics-style logging (noted as a potential indicator of LLM-assisted code, including messages prefixed with “Analytics:”) and is described as tracking and stealing data. CoinBait operators were observed hiding infrastructure behind Cloudflare and other trusted services to reduce detection. Google assessed with high confidence that a portion of CoinBait activity overlaps with UNC5356, a financially motivated threat cluster (noted as known for SMS and phone phishing).
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In November 2025, GTIG found COINBAIT, a phishing kit built with help from AI. It pretends to be a major crypto exchange to steal login details.
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A phishing kit referenced as being enhanced with AI-assisted capabilities (via Google Gemini) to support malicious campaigns; specific functionality beyond phishing is not described in the content.
AI-assisted phishing kit impersonating a major cryptocurrency exchange to steal credentials; implemented as a complex React site with analytics-style logging for tracking/exfiltration, and infrastructure obfuscated behind Cloudflare and other trusted services.
Phishing kit that impersonates a cryptocurrency exchange to harvest credentials; assessed to have been built/accelerated using AI code generation tools (Lovable AI mentioned).
AI-generated phishing kit that impersonates a cryptocurrency exchange to harvest credentials; some activity attributed to financially motivated cluster UNC5356.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.