PhishEye Blog
Field notes on phishing detection, typosquat enforcement, search-threat strategy, and the takedown metrics that actually reduce customer harm — not vanity dashboards.
Featured
Research · · 14 min readPart 1 of 2
An infostealer log exposed one operator inside a Middle East-wide Find My smishing ecosystem: 243 domains, 69 SMS gateways, and a pipeline run from Afghanistan with PhantomUltimate.
By PhishEye Research
Read more
Research · · 30 min read
One AI-built kit, five Egyptian banks, about 50 hostnames, and the same exposed Firebase database running fake Doha ticket shops whose checkout harvests cards.
Read more
Research · · 13 min read
A fake Hollyland sponsorship leads creators to Matchube, whose “Sign in with Google” is a proxied Google login that steals the session and the YouTube channel.
Read more
Research · · 16 min read
A fake Home Office 2FA notice hit our inbox. We trace the PDF, the Google Drive HTML file and the endpoint that collects SMS user IDs, passwords and dates of birth.
Read moreResearch · · 12 min read
Shared checkout scripts link historical hotel-booking phishing pages. Explore dated indicators, AS214351-hosted specimens, and separately classified registration leads.
Read moreResearch · · 19 min read
Phishing texts pointed at hostnames like revolut.com.93810.app, where the bank's name sits left of the registrable domain. DNS enumeration and wildcard certificate search each found about half the campaign; together they found 37 hostnames, 23 still live, running since July on DDoS-Guard infrastructure. crt.sh has none of the certificates.
Read moreResearch · · 26 min read
A live card harvester puts the brand in a subdomain of a domain the attacker already owns, behind a wildcard certificate that never carries the brand into a CT log. Permutation engines, CT monitoring, title search and screenshot comparison each miss it for a different reason.
Read moreResearch · · 9 min read
A compromised clinic site loads a ClickFix overlay that writes a command into the visitor's clipboard, then talks them through pasting it into Win+R or Terminal. On Windows it installs the real Bun runtime to evaluate stage two in memory; on macOS it pipes a Base64-hidden URL into zsh.
Read moreResearch · · 8 min read
A recipient-specific link leads through a math gate to an S3-hosted, Base64-encoded Outlook clone. We trace the Bing diversion, blob delivery and credential collection code, with defanged indicators for defenders.
Read moreResearch · · 10 min read
A live phishing site displays a real Microsoft authorization code and tells you to paste it into the genuine login page. No fake login, no password stolen, MFA completed by the victim - and the attacker walks away with access and refresh tokens. Full teardown with infrastructure analysis.
Read moreResearch · · 12 min read
AI-written lures, QR codes that jump to unmanaged phones, and PhaaS operators who replace a suspended domain in minutes have outrun the find-and-report model. The operating model that replaces it: containment before removal, infrastructure-level disruption, and metrics that measure customer protection.
Read moreResearch · · 8 min read
Over 21 hours a phishing operator hit three of our own mailboxes with spoofed [email protected] emails, rotating lures and cloned login pages across IPFS and Google Cloud Storage. We tear down all three waves, the Formspark exfil, and why DMARC quarantined every one.
Read moreResearch · · 8 min read
15+ Chrome utility extensions (emulators, password managers, converters) embed a bandwidth-sharing SDK that quietly turns the browser into a covert web-scraping proxy via hidden iframes and five Lambda backends. Unit 42's findings, analyzed for defenders.
Read moreResearch · · 8 min read
CAPTCHA gates, multi-step SaaS chains, blob-URL delivery, and Cyrillic look-alike source obfuscation: Unit 42 documented four ways device-code phishing pages dodge automated scanners. What each one defeats, and how defenders keep up.
Read moreResearch · · 8 min read
A new Rhadamanthys infostealer campaign resurfaced days after a law-enforcement takedown, delivered via a cloned RingCentral download, a 385MB anti-sandbox dropper, layered DLL side-loading, and Azure Front Door C2. Unit 42's full chain, analyzed for defenders.
Read moreResearch · · 9 min read
Two threat actors flooded RubyGems with 130+ trojanized copies of popular libraries carrying XMRig Monero miners, one of them worming across SSH and multiple languages. Unit 42's supply-chain findings, with defender guidance.
Read moreResearch · · 8 min read
Unit 42 is tracking an automated factory of 350+ fake VPN Chrome extensions that route every request through attacker-controlled SOCKS5 proxies, with only 14 removed so far. Our analysis of the campaign and the defender playbook.
Read moreResearch · · 12 min read
Starting from a handful of fake Grand Egyptian Museum ticket sites, we mapped an industrial fake-ticket network: 188 domains impersonating ~40 real attractions across 10+ countries, on a handful of shared origin servers.
Read moreResearch · · 12 min read
Hackers take over real hotel accounts on Booking.com, watch the incoming reservation queue, and message each guest a fake 'complete your booking' payment link. A full breakdown of the reservation-hijack scam, with a live example we traced and reported.
Read moreResearch · · 22 min read
Three independent 2026 datasets (Microsoft, APWG, KnowBe4) synthesized into one picture: volume up 13.8%, credential theft at 94%, AiTM up 139%, 85.8% of attacks AI-driven, Telecom the top target, and Cloudflare fronting 39% of phishing sites.
Read moreResearch · · 12 min read
A live SharePoint credential-phishing chain on free Cloudflare infrastructure: a fronted lure and fake-CAPTCHA redirect into a cloaked workers.dev loader, tracked across 5+ auto-provisioned Workers accounts.
Read moreResearch · · 13 min read
Cloudflare Drop deploys a static site to a workers.dev URL in seconds with no account. We weigh the phishing-abuse risk, compare it with other free static hosts, and show why Cloudflare's own abuse-report API blocks the takedown teams fighting back.
Read moreResearch · · 16 min read
One live phishing URL unrolled IronToll: a 90+ domain, multi-country phishing-as-a-service campaign built on the Chinese Iron Man kit, stealing credentials and live SMS OTPs. Full IOCs, C2 IPs, and the hunting method.
Read moreCybersecurity · · 8 min read
What threat intelligence feeds are, how CTI feeds work, the main types, and how to evaluate and operationalize them for phishing and brand defense.
Read moreCybersecurity · · 8 min read
Defend the two channels most brand-protection programs under-serve: social media impersonation and fake mobile apps — detection, per-platform takedowns, and how to choose a platform.
Read moreCybersecurity · · 11 min read
A buyer's checklist for brand protection teams: the four criteria that separate a fit-for-purpose phishing detection and takedown platform from a generic email-security tool.
Read moreCybersecurity · · 11 min read
PCI DSS v4.0 turned anti-phishing into a technical control. A pre-audit checklist mapping Requirements 5.4.1, 8.4.2 and 12.6 to DMARC, MFA, simulations and audit evidence.
Read moreResearch · · 15 min read
A live ClickFix campaign poisons your clipboard via a fake CAPTCHA and hides its C2 on the Polygon blockchain (EtherHiding) to defeat takedowns. Full chain, 97-domain IOC feed, defenses.
Read moreCybersecurity · · 12 min read
Trade name vs. trademark, how to register and enforce your business name, and how to defend it online against lookalike domains, fake profiles, and phishing.
Read moreCybersecurity · · 11 min read
Build a phishing-reporting pipeline with APIs: validate a URL, submit to Safe Browsing and urlscan, find host and registrar abuse contacts via RDAP, and escalate.
Read moreResearch · · 10 min read
PrizeBuzz runs one fake-prize-survey kit across 318 .buzz domains, cloning OMT, Coca-Cola, Vodafone and ~26 more brands over WhatsApp behind Cloudflare. IoCs inside.
Read moreResearch · · 11 min read
INTERPOL's Operation Ramz dismantled Sniper Dz, a decade-old phishing-as-a-service platform: 20,000+ domains, 80 brand kits, and 201 arrests across 13 countries.
Read moreCybersecurity · · 10 min read
Online brand protection explained: the threats, how detection and takedown work, the channels to cover, and how to build a program in 2026.
Read moreCybersecurity · · 9 min read
How phishing, website, and domain takedown services work — detection, evidence, registrar and host abuse channels, SLAs, recycle tracking, and how to choose a provider.
Read moreCybersecurity · · 9 min read
What brand protection software does, the types of tools (domain, social, ad, app, dark web), the features that matter, and how to choose the right one.
Read moreCybersecurity · · 8 min read
A step-by-step guide to getting a phishing website removed: confirm it, gather evidence, report to the host, registrar, and Safe Browsing, then escalate.
Read moreCybersecurity · · 9 min read
How to evaluate brand protection companies and vendors: provider categories, the criteria that matter, a 30-day pilot method, and red flags to avoid.
Read moreResearch · · 10 min read
A fake DirBuster 'GitHub' page weaponized ClickFix clipboard hijacking to run a base64/zsh one-liner that installs Atomic Stealer (AMOS) on macOS — no exploit, just copy-and-paste. Analysis, IoCs, and defenses.
Read moreResearch · · 8 min readPart 2 of 2
Defender annex: defanged live domains, nameserver pivots, PhantomUltimate kit fingerprints, timeline, and FAQ.
Read moreCybersecurity · · 18 min read
A practical 2026 playbook for detecting typosquat and lookalike domains, scoring risk, packaging evidence, and routing takedowns through the right channel.
Read moreCybersecurity · · 16 min read
A 2026 playbook for detecting and removing executive impersonation across email, social, voice, and deepfake channels — with severity, evidence, and KPI guidance.
Read moreCybersecurity · · 12 min read
How to run search threat monitoring for SEO poisoning, fake support sites, and paid impersonation with one evidence-led workflow.
Read moreCybersecurity · · 11 min read
A practical hybrid phishing detection architecture: where deterministic rules win, where AI adds value, and which KPIs prove impact.
Read moreCybersecurity · · 14 min read
Eleven brand protection platforms ranked on what each vendor’s own site states: modules, takedown claims, pricing model and free tiers, checked and dated.
Read moreCybersecurity · · 15 min read
A practical buyer checklist for phishing detection and takedown platforms, focused on alert-to-case conversion and closure metrics.
Read moreProduct updates · · 12 min read
Why enterprises centralize digital risk management across phishing, typosquatting, fake apps, and impersonation with shared governance.
Read moreCybersecurity · · 10 min read
Takedown KPIs beyond detection volume: time-to-triage, time-to-suspend, recycle rate, and search-channel exposure metrics.
Read moreSubscribe to the RSS feed for new posts, or get in touch about the investigations.
