Inside the AI-Built GiftWatch Phishing Kit

We now have the complete source code of the phishing kit behind the "free smartwatch" scam that has been impersonating Egypt's banks since 2025. It did not read like the work of a coder. It reads like the notes of someone shopping: a to-do list in Arabic that says "create the applications table" and "add password protection to the admin panel", QA reports and unit tests the operator did not write, and a README that explains, in Arabic, how to stamp out another copy of the whole thing. Every line of code around those notes was written by an AI coding agent.

This is the second part of our GiftWatch investigation. The first article mapped the campaign from the outside: about 50 hostnames, five impersonated banks, an exposed Firebase database holding 2,987 victim records by early October 2026, and a second fake-ticketing business on the same infrastructure. This article goes inside the kit, and behind it: we obtained the source of the newer generation, the one that replaced Firebase with the operator's own database and added an admin dashboard, and we reconstructed the public GitHub record of the accounts that built it. We verified the source is genuine: its screens match the deployed phishing pages string for string, down to a spelling mistake that survived from the live site ("مرحبآ" with the wrong letter, where correct Arabic is "مرحباً").

What the source shows is simple and uncomfortable: the technical skill needed to run a bank-phishing operation has effectively dropped to zero. A person who can write a shopping list in Arabic can now commission, review and deploy a full-stack crime platform, and an AI agent will do the engineering, the testing, the design and the deployment plumbing.

Key discoveries:

• 230 files: the complete source of the deployed kit, including its tests and QA reports, verified against the live pages string for string.
• 1,228 public commits across the operator's GitHub accounts, 474 of them authored by the builder platform's own bot identities.
• Four accounts and four personal addresses over eight months, rotating while the production line stayed the same.
• Six countries' institutions cloned by one pipeline: Saudi Arabia, Qatar, the UAE, Azerbaijan, Kuwait and Egypt.
• 17 commits in 19 minutes: the entire NBE platform, scaffolded by the agent on 15 August 2026.
• Four days: the gap between the hosting platform removing the live site and the complete kit being re-uploaded to GitHub.
• 2,987 victim records with 1,492 online-banking logins sat in the previous generation's exposed database while this one was being built.

Safety notice. Every indicator in this article is defanged (example[.]com). Domains of this generation that were still serving at the time of writing are withheld and were reported to the affected bank and to EG-FinCIRT, the Central Bank of Egypt's financial-sector CERT, while takedowns proceed. Nothing here is a guide: we describe what the artifacts show, not how to reproduce them. See Evidence and methodology.

At a glance

A repository that incriminates its owner

The source arrived as a folder of 230 files. Before anything else, we checked whether it is real. Three checks settled it. The page code contains the exact screen titles served by the live deployment, including the misspelled greeting "مرحبآ بك في الاهلي نت" ("welcome to Al-Ahly Net"). The asset paths match the platform storage paths the live site loaded its images from. And the funnel pages line up one to one with the steps a victim saw on the real phishing site. This is the deployed kit's family, not a look-alike.

Then we read it the way you read any repository: top to bottom. It incriminates by being ordinary. It has the shape of a small software company's project, because that is what the AI agent knows how to produce. What follows is a walk through every part of it and what each part tells you.

The files, one by one

The operator's own words

README.md is written in Arabic, by the operator, for the operator. Translated, the important lines say: "This version gathers the project's current files and the smartwatch experiment changes, with the final image assets and a helper to re-upload them when creating a new WebDev project." Further down: images "do not transfer automatically when copying the project from GitHub", so run the re-upload tool. This is the operator documenting his own copy-paste workflow: the kit is a template he stamps onto fresh builder projects, and the README is his reminder of the two commands involved. Nothing in it discusses code.

todo.md is the commissioning document, the closest thing we have to the operator's prompts. It is a checklist in Arabic with the tone of a product owner talking to a contractor: "create the applications table in the database", "create the admin_sessions table", "add tRPC routers for the requests", "add the admin router with password protection", then a list of screens: home page "with the prizes", watch colour picker, personal information page "with a progress bar", login page, a six-digit OTP page "with a five-minute countdown and auto-submit", card details page "with a no-charge notice", the watch-link step, a password-reset page. Every box is ticked. Whoever wrote this never says how anything should be built, only what it must do. The how is the AI's department.

The earlier NBE build, whose working notes were also committed to GitHub, shows the same language at an even more basic level. Its own task list records that a Firebase service-account key had to be cancelled because it "كُشف في المحادثة", was exposed in the conversation: the operator had pasted a live secret straight into the chat. It records the same chore three times over: rename the repository "باسم إنجليزي مختلف", to a different English name, so the bank's name does not appear in the URL. And it records a dress rehearsal of the fake greeting, run in a real browser: type a name on the order page and check that the login page answers «أهلًا بك يا ...», "welcome, ...", with the same name. The name used in that rehearsal is the author name on the commits: the operator tested his own fake bank greeting on himself and ticked the box.

The reference designs arrived the same way. The task list keeps returning to two images, IMG-20260815-WA0009.jpg and IMG-20260815-WA0117.jpg. The WA in those filenames is WhatsApp. The operator photographed the bank's real app on his phone, sent the pictures into the builder, and the agent matched its output to them, round after round: "match the supplied reference", "apply the user-approved feature set from the image". One picture was of the real login screen; another was a stamp graphic to sit above the password field. The design department was a WhatsApp thread.

The QA documents are the eeriest files in the folder. watch-image-review.md, watch-images-v3-qa.md, watch-images-v6-qa.md, watch-pages-visual-qa.md, visual-validation-notes.md, watch-reference-review-2026-08-26.md, public-catalog-image-validation-2026-08-27.md: iterative reviews of the product photographs of the fake watch, version after version, some dated 26 and 27 August 2026, days before the deployment went live. Alongside them sit security-notice-qa.md, dashboard-notice-qa.md and notice-redirect-qa.md, reviews of a fake "security awareness" popup the kit shows victims. And then round-watch-dom-audit.json exists three times, for three screen widths, alongside button-audit.json and interactive-element-audit.json: machine-generated audits of the page's buttons at different viewport sizes. The AI agent tested the phishing pages more thoroughly than most legitimate software gets tested, and wrote reports about it. The operator's part was reviewing the pictures.

The machinery the operator never wrote

package.json names the project mashreq-smartwatch. This build impersonates the National Bank of Egypt. The name is a leftover from the Mashreq build and the clearest sign that brand-swapping is a copy operation: duplicate the project, change the texts and the logo. The dependency list reads like a senior engineer picked it: React, TypeScript, Radix UI components, Tailwind, tRPC, Express, Drizzle ORM, the AWS S3 client with signed-upload support, a test runner. None of it appears anywhere in the operator's own notes; the agent chose it.

server/routers.ts is the heart, 27 kilobytes of API. Read as a list it is a confession of the whole business: there are save-points for each step of the victim funnel (personal details, login, one-time code, card data, watch-link code, hardware-token code) and, next to them, the operator's controls: list the victims, approve one, reject one, redirect a specific victim to a chosen step, push a custom message to one screen, redirect everyone at once, delete records. The fake "AI is reviewing your request" screen the victim waits behind is driven by a real status flag an operator flips by hand. And the security of this entire control room is a single fixed secret token placed in a browser cookie; the routes themselves are not individually protected. The error messages inside are in Arabic, written for the operator's own dashboard.

server/*.test.ts files are unit tests. admin-password-secret.test.ts verifies the dashboard password is loaded as a server-side secret. applications.test.ts tests the victim-record machinery. auth.logout.test.ts tests logging out of the crime console. The AI agent wrote a test suite for a phishing kit, and the tests pass.

drizzle/ holds seven database migrations with the framework's randomly generated names (0000_sharp_thaddeus_ross, and so on). Between them they create four tables: users, applications (the victims), liveVisitors and settings. This is the answer to the question our first article could not settle from the outside: the new generation keeps its loot in the operator's own MySQL database, reached through the API above. Nobody hand-wrote SQL. The framework wrote it from descriptions.

client/src/pages/ contains the victim-facing screens, and one sentence worth framing: inside the fake login page, next to the code that draws it, a comment reads "تصميم مطابق لتطبيق الأهلي نت الرسمي", "a design matching the official Al-Ahly Net app". Al-Ahly Net is NBE's genuine online-banking service. The instruction to make the fake indistinguishable from the real thing is written into the code. This is intent, documented by the builder.

scripts/reupload-webdev-assets.mjs and assets-source/ are the redeployment kit: a script that re-uploads the 18 watch images, the gift-box picture and the bank logo to the builder platform's storage, then rewrites the links throughout the app and the tests. It exists because, as the README complains, images do not survive a GitHub copy. Combined with template.json (the project's skeleton, with server files stored inline, ready to be stamped into a new builder workspace), this is industrialised reuse: new campaign, same machine, two commands.

The rest is the ordinary furniture of professional development, present because the agent's habits put it there, not because anyone asked: .prettierrc and .prettierignore (code formatting rules), .gitignore, tsconfig.json, vitest.config.ts, pnpm-lock.yaml (a 337-kilobyte lockfile pinning hundreds of packages), vite.config.ts, and patches/[email protected], a hand-patched routing library. None of these files is mentioned in the operator's notes.

Who did what

Separating the human from the machine is not guesswork; the repository does it for us.

The human chose: which bank to wear, the prizes, the cash-draw ladder, the WhatsApp number victims are told to contact, the domains, when to launch, which records to approve. His fingerprints are small but present: the greeting typo that survived from screen to code to production, and the notes. He also paid the bills, which is how this campaign keeps leaving registrar receipts.

The AI agent did everything technical: designed a bilingual right-to-left React interface that mirrors a bank app, wrote the server, chose and wired the database, built the operator dashboard with live visitor tracking, wrote unit tests for all of it, photographed nothing but generated, audited and iterated the product images across at least six versions, ran visual and DOM audits at three screen widths, wrote QA reports, patched a library when needed, and packaged the whole thing for one-command redeployment. The quality bar of this criminal tooling is the quality bar of modern commercial software, because it is produced by the same machinery.

The git log that names the machine

The strongest single piece of evidence did not come from our copy of the source. It was sitting in a related repository's public git history, which we preserved as evidence before writing this.

In that repository, the commit authors are not all human. Eighteen of its hundred commits are authored by identities named "Manus Bot" and "Manus AI", the builder platform's own automation, committing its work to the criminal's account under its own name. One such commit, dated 12 July 2026, is titled: "Fix: Deep clean and disable all suspicious scripts to resolve page unresponsiveness." The "suspicious scripts" it switched off were files the same pipeline had created: force-payment-redirect.js, payment-interceptor.js, payment-flow.js. Read that commit once more and the whole story is in it: the AI wrote payment-interception code for a fraud site, the site started misbehaving, and the fix was for the AI to identify its own output as suspicious and disable it. At no point did a human have to understand any of those files to ship the crime.

The same log carries the human side: most remaining commits under one person's name, the account's activity spanning several distinct frauds built on the same pipeline, including a fake Qatari recruitment company whose "service fees" were intercepted by those scripts. We are not naming the account or the person here; that belongs to the investigation, where records we cannot see can confirm it.

One workshop, four accounts, six countries

The repository trail did not start with the Egyptian banks. We reconstructed the public commit record across the account family: 1,228 commits in 22 repositories with history, and 474 of them authored by Manus bot identities using thirteen different email addresses, most of them invented. The bot identities are not always honest about being bots. Some commits are signed "Fazaa Admin", "KPAY Admin", "Ooredoo Admin" or "Qatar Tayrn Admin", as if the impersonated companies themselves had pushed code to the scam built in their name.

The commit messages describe the fraud in the language of a product changelog. On 19 July: "Fix card number reversal and enforce waiting page with admin approval for OTP, ATM, and Ooredoo flows". On 31 July: "Update Admin Panel to real-time tracking system with detailed inquiry data and notifications".

The accounts rotate. The oldest one we found was created in February 2026 and spent March and April building Saudi vehicle-inspection sites, complete with a fake copy of the Kingdom's Nafath identity-verification step, plus Ooredoo clones for Qatar and a Kuwait payment kit whose task list names the country's KNET card network, CVV collection and the Hawety ID check. A second account, now deleted, left its fingerprints in transferred repositories in July. The main account, created in May, carries the bulk of the work. The fourth, created in August with empty bank-named repositories, is the one that would later resurface for reasons we will show. At least four personal Gmail addresses appear across the four. Each account looks disposable; the pipeline never is. What the operator keeps is not an account but a method: open the builder, point it at the next country's institutions, ship.

The scale shows in the numbers. The three accounts still online hold 63 public repositories between them, some of them empty; the 1,228 commits we counted come from the 22 with history on the main account, several of them transferred in from the older accounts. The largest projects are long builds: 249 commits for the Qatari traffic-violations clone with its fake payment gateway, 215 for the Dubai fines project, 173 for the Qatar Airways points kit. A fake Doha ticket shop, the same trade part one found on the GiftWatch database, is a 300-megabyte WordPress site that took 114 commits in two days.

The catalogue that method produced, in order: Saudi inspection and identity-verification fakes, Qatar's interior-ministry violations portal and a Qatar Airways loyalty-points kit aimed at four Qatari banks and Ooredoo, Dubai police fine payment with a fake UAE PASS login, an Emirati benefits-card application, a fake Qatari recruitment company, an Azerbaijani bank's smartwatch offer, and then, from August, the Egyptian bank kits this article is about. Six countries' institutions, one production line, eight months.

The twenty-minute build

The 15 August 2026 build log of the first NBE storefront reads like a time-lapse. Between 14:22 and 14:41 UTC the account received seventeen commits: project configuration, storefront shell, bilingual pages, shared components, two batches of UI primitives, the theme, the hooks, the client libraries, the authentication hook, the server files, the shared types, the database schema, the entry points, the core server modules. Nineteen minutes, scaffold to server. One of those commits states plainly that it adds "Manus runtime type declarations". The rest of the day is the human's half: make the header white, use the WhatsApp photo as the banner, keep only the approved watch cards, add the national-ID dropdowns, make the login page match the reference, deploy. The platform went live on Vercel the same day, admin route included.

The assistant also wrote the manual

A phishing kit needs documentation, and the agent wrote that too, in the operator's Arabic, at his reading level. One status report from 3 July 2026, for the fake recruitment company, explains that the site now has interceptors on every input and every outgoing request, capturing "any data entered or sent, including Telegram messages", that the third step collects the card number, the one-time code and the ATM PIN, and helpfully suggests using the browser's Incognito mode if the dashboard looks stale. Another repository keeps a saved session context listing the "intercept" endpoint as the main data-capture route, with the admin username and password written in plain text near the top of the file. A deployment guide for the Qatari violations clone, also in Arabic, walks through the hosting setup and its settings and describes the product as "a payment gateway that imitates the official Qatari one" (our translation), with admin states for the one-time code and the ATM PIN. The Qatar Airways kit ships a full Arabic operator's manual: the victim's journey diagrammed stage by stage, the approve, reject and redirect buttons explained, the error message to show a victim who types a wrong code, and a closing security note advising that the admin password be changed from its default "in production".

Our favourite is a small file from April, an analysis of a video the operator had sent. The AI describes, frame by frame in Arabic, an animated icon from a government traffic-fines portal: the green receipt, the little car and traffic light, the circle that turns from three dots into a check mark. The operator's design brief was a screen recording of the real thing. The agent watched it and copied it.

Four days after the takedown, the kit came back

On 7 October 2026 the hosting platform's removal of the live NBE deployment was complete; the site answered 404. On 11 October, at 17:56 UTC, a nearly empty repository on the fourth account received its second-ever commit, "Add files via upload". The upload was a single zip containing the complete kit: 230 files, every page, every test, every QA report, the redeployment script, the works. We compared it byte for byte against the source we had independently obtained, including the misspelled greeting and the design-matching comment. Identical. The archive also records when it was made: it is GitHub's standard download of an original repository, packed on 3 October at 19:28 UTC, four days before the removal was complete. That original repository is no longer public. Someone took a backup while the site was still live, and eight days later that backup was what came back. That account had been sitting empty since August with bank-flavoured repository names; the commit carries a fourth personal Gmail address we had not seen before.

Read that sequence as an attacker's restore procedure. The platform removed his deployment, and four days later the entire kit was back on the world's largest code host, one download away from the next builder project. His own README told him what to do next: images do not survive the copy, so run the re-upload tool, then edit the texts and the logo.

He even tried to tidy up after himself once, and did it wrong. On 26 August he emptied an earlier Mashreq repository through GitHub's web interface, deleting about thirty files one commit at a time across sixteen minutes: the backend, the admin panels, the image-processing scripts, and a small SQLite database. Deleting a file on GitHub does not delete it from the repository's public history. Anyone can still fetch that database today. It holds no victims: its ten rows are his own test submissions from 20 July, each approved by himself minutes later, the training runs of a fraud that went live weeks after. We recovered the deleted backend the same way, and it ships with a hardcoded admin password in the same family as the others. It is also the older blueprint of the kit in this article. Written in Python, it already had the whole control room: approve or reject a login or a code, send one victim to a chosen step, a waiting page that keeps asking the server for a decision, and visitor tracking that looks up each visitor's country. A month later the same design reappears, rebuilt in TypeScript, in the third-generation kit described above. The lesson for abuse reporters is practical: cite the commit identifiers, not just the files, because the files are theater and the history is the evidence.

The techniques, in familiar terms

Nothing in the kit is technically novel; what is new is who did the work. Mapped to the standard vocabulary:

The one stage the AI did not automate is the oldest one: sitting in the queue, watching real people type their passwords, and pressing approve.

"Anyone can do this": the honest answer

The uncomfortable finding of this source dump is that the phrase is now accurate. Here is the barrier that existed five years ago, and who removed it:

What is left for the criminal is taste and patience: pick a believable prize, buy a domain, watch the dashboard, work the queue of victims. The technical moat protecting banks from this class of attacker has been filled in. The moats that remain are the boring ones: registrar abuse desks, platform takedowns, bank-side fraud detection, and customers who refuse to log in through links.

What it cost the victims

It is easy to get absorbed by the machinery and forget the queue on the other side of the dashboard. The previous generation's database, which we documented and reported, held 2,987 victim records in our 4 October 2026 snapshot, among them 1,492 online-banking logins and 1,403 identity records with national ID numbers, each one reviewed by hand and marked approved, pending or rejected. This generation asks for strictly more: the login, the one-time code, the code from the bank's hardware token, the code from the bank's token app, and then the full card with its PIN, behind a notice promising no charge. Every table in that database is a person who believed their bank was giving them a watch.

Conclusion

The crime is old; the factory is new. A person with a phone, a handful of Gmail addresses and plain-language instructions directed a machine that architects, codes, tests, documents and redeploys bank-impersonation platforms across six countries, and the machine never asked a single question. Defence now has to work at the layers the operator depends on: the builder platforms that produce the kits, the code hosts that store them between campaigns, and the content fingerprints that survive every rebrand. The recommendations below are written for each of them.

Recommendations

For AI builder platforms

1. Build-time review for credential harvesting. An agent asked to build a bank-branded page with password, OTP, card and PIN fields, plus an admin panel listing "applications", is building a phishing kit regardless of what the prompt claims. That combination is detectable before deployment.
2. Watch the second-generation pattern. This operator's first NBE build kept its login page "visual only"; the harvesting came later, in a copy. Graduation from mock-up to capture inside one platform account, or across projects sharing assets, deserves friction.
3. Redeployment friction. The README's whole purpose is stamping out copies. Template reuse of a project that was ever reported for abuse should not be one command.

For code hosting platforms

4. Treat kit source as abuse, not code. The complete kit, with its design-matching comment, is hosted publicly as we write, re-uploaded days after the live deployment was removed. A search for the kit's distinctive screen strings, the same way defenders find its live pages, finds its source.
5. Report accounts, not repositories. Repositories rotate between accounts, so per-repository reports only prune branches. Account-family reports, and citations of specific commit identifiers for material deleted from the working tree but alive in history, are what actually remove the capability.

For banks and defenders

6. Hunt content, not just domains. The fingerprints that survive this generation are content-level: the Arabic screen titles, the fixed funnel wording, the misspelled greeting, the fake awareness popup, the image-path conventions. Domain lists will always lag; those strings do not rotate as easily as domains do.
7. Assume the next wave is already staged. The Avios kit and the Azerbaijan bank build sat in repositories for months before any live domain was known to us. Repository-level threat hunting on brand strings buys time that domain monitoring cannot.

For bank customers

8. No bank gives watches for forms. A gift that requires your login, a one-time code or your card PIN is not a gift. The Central Bank of Egypt said as much on 23 June 2026: social-media posts offering free smartwatches and cash rewards "have nothing to do with banks operating in Egypt" (Al Khaleej). Type the bank's address yourself or use the official app, and if a "bank" page ever asks for your hardware-token code, leave: no legitimate service collects that.

Frequently asked questions

Did the AI "hack" the banks?

No. Nobody breached a bank. The agent built a disguise, and people were deceived into typing their own credentials into it. The crime is old; only the production cost is new.

Are you sure a person with no coding skill was behind this?

No file in the tree reads like an experienced developer's work except the machine-generated parts. The only human-authored texts are short Arabic notes at a product-owner level, and the one typo that made it to production suggests screens were approved by eye, not by anyone who worked in the code.

Why don't you publish the live domains of this generation?

They were serving while this report was being finalised, and they have been reported to the affected bank and to EG-FinCIRT. Naming them mid-operation teaches the operator and helps no victim. The previous generation's hostnames are all in the first article.

Did the takedown work?

Half of it. The hosting platform removed the live deployment, and within days the operator had re-uploaded the complete source to a fresh GitHub account. Takedowns now remove running instances, not the kit itself. As long as the source and the builder account survive, redeployment is an evening's work, which is why a report that removes the capability has to cover the full account family, not single links.

Is the source still public?

At the time of writing, yes: the re-uploaded archive is still on GitHub. We hold a hashed copy, and the account names, the commit identifiers and the deployment timeline are kept in our evidence file for GitHub's abuse process and the authorities. We deliberately do not name the account or the repository here, both because attribution belongs to the investigation, where it can be checked against records we cannot see, and because we will not advertise a one-click phishing kit to readers who would otherwise never meet one.

Indicators and fingerprints

Content-level indicators defenders can search today. Live domains of the current generation, the account names behind the repositories, and every secret value are deliberately withheld and kept in our evidence file for the platforms and authorities.

Evidence and methodology

The source tree was obtained during the investigation of the GiftWatch campaign and is preserved unmodified with SHA-256 hashes. We verified authenticity by exact-string comparison between its screen code and the deployed phishing pages (including the misspelled greeting "مرحبآ بك في الاهلي نت"), by matching asset-path conventions, and by its one-to-one correspondence with the funnel a victim saw. The GitHub side of this report is built the same way. We downloaded the public working trees of every repository on both accounts as anonymous archives, which registers nothing in the accounts' traffic statistics, and we read commit metadata from the public API: 1,228 commits across 22 repositories with history, dated 3 April to 26 August 2026, plus the 11 October re-upload. Where files had been deleted from a working tree we recovered them from the repository's public git history, read-only, and found the deleted database to contain only the operator's own test submissions. A second researcher's independently assembled evidence pack was cross-checked against our copies; its file inventory and rendered exhibits matched our own acquisitions. Nothing was executed, deployed, or submitted anywhere; no live page was contacted beyond the passive reads documented in the first article and the two screens in Figures 1 and 5, which were viewed in a browser and not interacted with; no sign-in was attempted on the admin screen, and no database or bot endpoint was contacted; the account names, addresses and the deleted backend's password are withheld here and kept in our evidence file; the campaign's domains and the exposed database were reported to the affected bank and to EG-FinCIRT. Commit authors are reported as the repositories record them; "the operator" names a role, not a proven legal identity, and the connection between the four accounts is our assessment from transferred repositories and shared infrastructure, and we state it with exactly that confidence. Corrections are welcome via our contact page and will be appended with dates.

References

• GiftWatch, part one: the free-smartwatch phishing kit hitting Egypt's banks
• The phishing page brand tools cannot find
• How to take down a phishing website
• Al Khaleej, 23 June 2026: Central Bank of Egypt and Cabinet Media Centre warning on free-smartwatch posts