Expert in Credential Phishing and Phishing Kit Research. Working in Cyber Security - Threat Intelligence #Phishing
UK
Joined August 2017
- Tweets9.4K
- Following74
- Followers9.7K
- Likes24.1K
Using the new @urlscanio Files feature, I recently uncovered a targeted Indian eChallan malware campaign! 📱 🇮🇳
🎯 Here is how the attack chain unfolded:
The best part? By leveraging urlscan.io file capabilities, I was able to seamlessly upload the screenshot, scan the malicious landing page, and extract the APK for full analysis - all within a single workflow. 📈
I am observing a wave of RingGo Parking themed SMS campaigns linked to the Chinese phishing framework known as Sailor 📱 🇨🇳
🛥️Sailor has seen a massive drop in terms of page volumes but they are not dead and this latest UK targeted campaign shows this.
This is a highly targeted banking cluster 🏦
🌐Clustering on web infrastructure was pivotal in this investigation
These admin panels are critical to managing this campaign 🎯
Jake | JCyberSec_ retweeted
We pivoted on NS infrastructure to uncover a UK banking phishing network powered by two central panels: FastFlux and FluxPanel. Pages prompt victims for a 6-digit code provided by a phone "advisor" to trigger downloads of a RAT disguised as verification.
Report on urlscan Pro.
Jake | JCyberSec_ retweeted
This report is now available on our public blog as well: urlscan.io/blog/2026/08/17/I…
This is awesome - Level up your urlscan skills with this interactive platform.
Wounder what challenges we could create next for it 👿
urlscan Pro University is officially LIVE!
Master urlscan search through hands-on challenges - from basic to advanced
Discover typosquat detection, threat verdicts, and phish hunting.
Solve challenges, submit flags, track your progress.
pro.urlscan.io/university
It always surprises me how companies rarely have unique ideas or thoughts. Everyone just copies everyone else.
Maybe someone should actually stop and think - Is this really the best way to be labeling threat clusters?
The answer is No. But because others do it we should copy.
CY-Kit (sorry for the boring name) is a new, previously undocumented, Chinese language phishing as a service kit 🇨🇳
🔎Read the public blog now with a more in-depth report for Pro users.
🥷🏼All scans linked to this framework are labelled on urlscan Pro making attribution easy!
New report 🚨
CY-Kit leverages socket-based communication and structured config files to manage phishing workflows.
A flexible framework built for scalable campaign execution.
The report is available on our public blog: urlscan.io/blog/2026/06/22/C…
You must have heard of #Chenlun - A huge Chinese phishing framework 🌐
🔎All our automated detections are now clustered and attributed on @urlscanio Pro
💥Read our new threat intel report into this framework to know how to attribute, defend & mitigate the risk posed by this kit
New TI report 📷
Chenlun (“Outsider”) is a feature-rich phishing kit using modern web frameworks, verification flows, and anti-bot techniques.
A step up in sophistication across Chinese Phishing-as-a-Service ecosystems.
Full analysis + detections 📷
urlscan.io/pricing/urlscanpr…
This is a much smaller Chinese phishing framework🇨🇳
🪙I bet you won't have heard of it before!
🌐What makes this notable is the targeting of Chinese companies by the framework🔎
🎯This is a Pro only report
✉️Reach out to sales@ if you are not on the pro platform!
New TI report on urlscan Pro 📷
Flyfish is a lightweight phishing kit built around simple but effective API endpoints.
Despite its simplicity, it’s actively used for large-scale victim interaction and data capture.
Detection patterns included 📷
urlscan.io/pricing/urlscanpr…
If you have been tracking phishing kits you will have come across Darcula 🧛
🔢 There are 3 main version as well as fake shops all linked to this framework.
📚 Read the in-depth analysis on urlscan Pro platform, and the free version is on the blog now.
New report: Darcula (“Magic Cat”) is one of the most active phishing frameworks we’re tracking.
From API-driven infra to socket-based comms and fake shop deployments, this kit continues to evolve rapidly.
Breakdown, detections: urlscan.io/blog/2026/05/11/C…
Full report on urlscan Pro
And we are off! The first in the series.
⚠️This one focuses on the newest and most rampant framework we are observing - ⚓Sailers Framework
Previously undocumented at this depth 🎯
🔎Pro intel users: pro.urlscan.io/intel/reports…
🔑Free report: urlscan.io/blog/2026/05/04/C…
New urlscan report 🚨
We’re kicking off our Chinese phishing series with a deep dive into the Sailor framework.
A modular kit leveraging client-side storage for session tracking and victim management at scale.
Detection included 👇
urlscan.io/blog/2026/05/04/C…
This is going to be huge 🧨
🔎Myself and the team worked so hard on these. It is going to uncover and expose the true scale of multiple frameworks
Watch this space...
New research drop 🚨
We're diving deep into Chinese-language phishing-as-a-service ecosystems powering large-scale global campaigns. From infrastructure to operations, this series uncovers how these platforms scale and evade detection. Starting May 4th:
urlscan.io/blog/2026/04/27/C…
