Outsider Phishing Kit Survives Takedown With 700 New Pages
Group-IB found the Outsider phishing kit kept generating 700+ new phishing pages within a month of Operation Ghost Hook's takedown.
Group-IB linked the Outsider Phishing Kit, operated by a threat actor known as ChenLun, to more than 100,000 phishing pages across 54+ countries between December 2025 and May 2026. After the FBI, Google, and Lumen's Black Lotus Labs seized core admin servers, a Shopify storefront, about $100,000, and thousands of domains under Operation Ghost Hook in June, over 700 new phishing domains appeared within a month. The kit offered 267 templates, adversary-in-the-middle MFA interception, WebSocket-based live operator communication, and SMS delivery via a Telegram affiliate ecosystem with more than 5,000 subscribers.
- Kit served 267 templates for finance, telecom, postal, government, and toll scams
- AiTM component dynamically served MFA challenges and relayed victim input in real time via WebSockets
- Smishing campaign impersonated Singapore's LTA to harvest data for SMS code interception
- Researchers recommend tracking file-name signatures to trigger phishing page takedowns
- Operation Ghost Hook seized admin servers, roughly $100,000, and thousands of domains
- Threat actors
- ChenLun
- Organizations
- FBIOperation Ghost Hook
- Countries
- Singapore
From the original article
2 min read at infosecurity-magazine.com
Outsider phishing kit generated 700 new pages after a Google-led disruption
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.