Loading story…
The ChenLun-operated Outsider Phishing Kit phishing-as-a-service operation remained active after Operation Ghost Hook disrupted its infrastructure, domains, cryptocurrency wallets, and Shopify storefront. Group-IB identified more than 700 newly created phishing pages in the month after the action, indicating that affiliates retained access to the kit or its underlying capabilities despite the seizure of core assets. Google had filed a civil lawsuit against the operation before the FBI, Google, and Lumen Black Lotus Labs announced the disruption.
From December 2025 through May 2026, Outsider generated more than 100,000 phishing pages across at least 54 countries using 267 templates impersonating financial institutions, telecom providers, postal and shipping services, government agencies, toll operators, brokerages, and e-commerce brands. The platform primarily distributes SMS phishing and provides adversary-in-the-middle interception, live WebSocket-based operator interaction, configurable MFA prompts, session tracking, crawler detection, and real-time theft of credentials, payment-card data, and authentication codes.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Within a month of the lawsuit and Operation Ghost Hook, Group-IB identified more than 700 additional Outsider phishing pages. The new pages indicated that affiliates retained the ability to use the phishing kit despite the disruption of its core infrastructure.
The FBI Cyber Division announced Operation Ghost Hook with Google and Lumen Black Lotus Labs to dismantle Outsider infrastructure. The operation seized core administrative servers, a Shopify storefront, about $100,000 in payment-wallet funds, and thousands of domains registered through U.S. providers.
Google filed a civil lawsuit against the Outsider group, which Group-IB attributes to the threat actor ChenLun.
Between December 2025 and May 2026, Group-IB identified more than 100,000 phishing pages generated by the ChenLun-attributed Outsider phishing-as-a-service operation. The campaigns used at least 267 templates and targeted victims in more than 54 countries, primarily through SMS phishing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourcegroup-ib.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two large phishing operations that used legitimate or compromised infrastructure to impersonate trusted brands and harvest victim data at scale. Group-IB said the **GitBait** campaign targeted at least 24 financial institutions in Mexico over more than three years by abusing GitHub Pages to host fake banking portals across more than 200 domains. The kit used client-side JavaScript to capture credentials and exfiltrate them through the SheetBest API into attacker-controlled Google Sheets, while at least one variant also forwarded data to a Telegram bot. Investigators said the modular phishing kit supported desktop and mobile devices and included an internal selector to switch between bank brands, complicating detection and takedown efforts. A separate campaign targeted millions of UK shoppers with fake **Boots** emails promising a free beauty sample pack and directing victims to a bogus survey and checkout page hosted on a compromised Bolivian government website. Researchers linked that activity to Romanian threat actors and found the emails were sent with **Gammadyne Mailer** installed on a compromised UK business terminal server, masking the operation behind the victim organization's internet connection. The same toolkit has reportedly appeared on multiple compromised systems since July 2025 and has also been used in tax-themed and cryptocurrency lures, underscoring a broader effort to exploit trusted brands, public-sector websites, and hijacked business infrastructure for credential and personal-data theft.
Jun 29, 2026
A Smishing Triad operator cluster tracked as **Outsider** is deploying the reusable **JWR** phishing kit in SMS campaigns impersonating toll, delivery, payment, and account-verification services. Shortened links send targets to short-lived, brand-skinned phishing pages where a persistent WebSocket connection streams every form-field update—including payment-card details, credentials, PINs, and one-time passcodes—to operators before the victim submits the form. Operators can steer victims through up to 32 pages or in-page transitions; JWR falls back to HTTP long polling at two-second intervals when WebSockets are unavailable. The same tooling has been linked to fraudulent Shopify storefronts promoted through malicious Google Shopping ads. A checkout redirect script routes shoppers to attacker-controlled payment pages, while Shopify Admin API order confirmations help make the transactions appear legitimate; a related Playswing kit provides separate MQTT-backed phishing infrastructure. Researchers reported more than 2,000 active fake stores, with roughly 100 added weekly. Although domains and brand templates rotate rapidly, defenders can hunt for JWR storage keys, JavaScript and page names, API and WebSocket paths, tokens, session naming, traffic patterns, and related WordPress or Shopify integration markers; extracted indicators should be validated before blocking.
Sep 16, 2026
Threat actors have launched a sophisticated phishing campaign targeting U.S. universities by leveraging the open-source Evilginx framework. At least 18 educational institutions have been affected since April 2025, with attackers using personalized emails containing TinyURL links that redirect to dynamically generated phishing pages. These pages closely mimic student single sign-on portals and employ advanced evasion techniques, such as expiring URLs, wildcard TLS certificates, bot filtering, and JavaScript obfuscation, making detection and mitigation increasingly difficult. The campaign demonstrates the growing accessibility of advanced phishing tools, enabling even unskilled actors to bypass multi-factor authentication and compromise sensitive credentials. Simultaneously, a new phishing kit called Spiderman has emerged on the dark web, targeting customers of major European banks and cryptocurrency platforms. This full-stack kit allows attackers to easily clone login pages for dozens of financial institutions and conduct real-time credential theft across multiple countries. With a large user community and features that facilitate immediate data exfiltration and hybrid fraud operations, Spiderman represents a significant escalation in the scale and efficiency of phishing threats facing the financial sector. Both campaigns highlight the evolving landscape of phishing, where sophisticated toolkits are lowering the barrier to entry for cybercriminals and increasing the risk to organizations worldwide.
Jun 29, 2026