A phishing-as-a-service (PaaS) operation has continued generating new campaigns despite a coordinated takedown effort, with more than 700 new phishing pages identified within a month of the disruption.
Group-IB said its researchers had tracked the Outsider Phishing Kit, operated by a threat actor known as ChenLun, and identified more than 100,000 phishing pages targeting 54 or more countries between December 2025 and May 2026.
The research, published on September 3, found the activity persisted after Google filed a civil lawsuit against the group on June 12 and the FBI’s Cyber Division announced a coordinated effort with Google and Lumen’s Black Lotus Labs, dubbed Operation Ghost Hook, the following day.
The FBI said the operation seized the group’s core admin servers, a Shopify storefront, about $100,000 from its payment wallets and thousands of domains registered through US providers.
New Phishing Pages Appear After Takedown
Group-IB had linked more than 10,000 unique domains to Outsider before Operation Ghost Hook. It has since identified more than 700 additional domains, indicating affiliates continued using the kit despite efforts to dismantle its infrastructure.
The platform contained 267 ready-made phishing templates covering financial services, brokerage firms, telecommunications providers, postal services, government and toll systems. The campaigns were delivered through SMS and distributed through a Telegram ecosystem for selling the kit and managing affiliates.
ChenLun has since deleted that Telegram channel. Before its suspension, Group-IB said the main group had more than 5000 subscribers and more than 230 users who had bought the kit.
Read more on phishing takedowns: Tycoon2FA Phishing Service Resumes Activity Post-Takedown
Researchers examined a smishing campaign impersonating Singapore’s Land Transport Authority (LTA). The messages created urgency around an alleged data synchronization issue and included instructions telling recipients how to defeat their handset’s own spam filtering.
The cloned portal collected vehicle registration numbers and phone numbers before redirecting victims to fraudulent payment screens. Group-IB said the harvested numbers were intended for intercepting SMS authentication codes at a later stage.
Live Interaction Supports Credential Theft
The Outsider Phishing Kit included adversary-in-the-middle (AiTM) capabilities designed to interact with victims during the phishing flow.
Group-IB said operators could dynamically serve SMS, email, PIN or app-based multifactor authentication (MFA) challenges and redirect victims back to earlier pages to request additional payment information.
The kit also used WebSockets to provide live communication between phishing pages and an operator panel. Data entered by victims could be transmitted in real time, including when a user abandoned a form before submitting it.
Group-IB identified JavaScript components that captured financial details, bank credentials, PayPal information and authentication codes. The researchers also found mechanisms for tracking victims across browser sessions and detecting security crawlers.
The pages followed a consistent file-naming convention, with an alphabetical prefix marking the victim’s stage in the attack flow. Group-IB recommended that organizations track new pages through those file-name signatures to trigger takedowns.
To protect against the threat, the company also recommended continuous monitoring for SMS-linked brand abuse, and advised individuals to verify alerts through official apps rather than message links.
