The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action

Introduction

During an investigation into phishing kits sold, Group-IB researchers uncovered the “Outsider Phishing Kit” (局外人), a sophisticated Phishing-as-a-Service (PaaS) platform operated by the threat actor known as “ChenLun.” The kit incorporates Adversary-in-the-Middle (AiTM) capabilities, enabling attackers to intercept authentication flows and bypass multi-factor authentication (MFA).

The scale of this operation is staggering. From December 2025 to May 2026, Group-IB has identified over 100,000 phishing pages targeting 54+ countries, leveraging 267 (and growing) phishing templates. These numbers underscore the increasingly low barrier to entry for threat actors to launch and operate large-scale phishing campaigns.

Recognizing the threat, Google filed a civil lawsuit against the Outsider group on June 12, with the FBI cyber division announcing a coordinated partnership with Google and Lumen’s Black Lotus Labs on June 13 to dismantle the group’s infrastructure, an effort dubbed Operation Ghost Hook. However, despite these significant takedown efforts, the threat persists. Group-IB’s Threat Intelligence team has identified over 700 new phishing pages created within just one month after the civil lawsuit, indicating that affiliates continue to actively utilize the Outsider kit.

In this blog, we examine the impersonated brands, phishing flow, page analysis, and the operator panel used to manage these campaigns

Key discoveries in the blog

• Over 700 new phishing pages identified since the lawsuit and Operation Ghost hook.
• 267+ ready made phishing templates.
• The past campaign has targeted more than 54 countries across the financial services, telecommunications, logistics, ETC and fines sectors.
• The campaigns are delivered via SMS.
• The phishing kits are distributed via a dedicated Telegram ecosystem.
• Operators used a WebSocket connection for live keylogging and to manipulate MFA challenges.
• Identified unique HTML filename prefixes that function as status codes to trace the victim’s precise stage within the phishing attack flow.

Who may find this blog interesting:

• Cybersecurity analysts and corporate security teams
• Threat intelligence specialists
• Cyber investigators
• Computer Emergency Response Teams (CERT)
• Law enforcement investigators
• Cyber police forces

Group-IB Threat Intelligence Portal

Group-IB customers can access our Threat Intelligence portal for more information about the threat actor designated as Chenlun and the phishing kit known as Outsider described in this blog.

Victimology

Figure 1: Outsider phishing kit global victimology map.

Figure 2: Outsider phishing kit identified phishing template categories.

Attack Flow

The Group-IB Threat Intelligence team received a smishing message leading to a phishing website impersonating the online identity of the Singapore Land Transport Authority (LTA). This SMS message was received three weeks after the announcement of Operation Ghost Hook and the dismantling of the Outsider Phishing-as-a-Service.

Figure 3. Example of a smishing message received impersonating Singapore’s LTA.

Impersonating Singapore’s LTA, the smishing text warns recipients of a pending data synchronization and demands action by “end-of-day” to create urgency. Today, many modern phones benefit from some level of built-in spam protection. An iPhone for example, is able to filter out potential spam messages from unverified phone numbers and block links unless the victim replies to the message or manually enters the URL. Recognizing this defense mechanism, the threat actors have even provided explicit step-by-step instructions within the phishing message to guide victims in circumventing this protection.

Figure 4. Landing page of the phishing site impersonating LTA’s online identity.

Clicking (or following) the link redirected victims to a cloned LTA portal requesting vehicle registration numbers and phone numbers. While the phishing page mimics the legitimate LTA interface, no actual authentication occurred here. It is observed to function solely as a data harvesting mechanism. The harvested phone numbers are specifically intended to be used to intercept SMS-based multi-factor authentication codes during subsequent attack phases.

Figure 5. Example of the phishing page showcasing an error and request for payment.

Upon submission, victims were redirected to a fraudulent payment notice claiming an outstanding fee. Fear-mongering language threatened additional penalties to pressure victims into immediate payment, exploiting urgency to bypass rational decision-making.

Figure 6. Example of the malicious payment page on the phishing site.

Once hooked, victims were prompted to enter their payment card details. The page’s malicious JavaScript (main.js) transmitted all entered information directly to the operator’s command panel in real-time, independent of whether the victim submitted the form or abandoned the session. This ensured credential capture regardless of victim action.

Figure 7. Example of a fake turnstile for affiliates to redirect a victim.

Following card entry, victims encountered a fake payment gateway interface. The operator then dynamically served contextual 2FA challenges, including SMS verification, email verification, PIN entry, or app-based authentication, based on the institution’s expected authentication requirements. Operators are observed to retain the capability to redirect victims back to the payment page to solicit additional card details, enabling multi-card harvesting from a single victim.

Phishing Page Investigation

A pattern emerges in the naming convention

When Group-IB researchers analyzed the multitude of phishing pages within the Outsider Phishing Kit, a pattern was discovered, ChenLun had fallen into a pattern of habit.

A consistent naming convention was observed across the kit’s phishing pages, following a structured pattern of an alphabetical prefix followed by a descriptive identifier (e.g., a_<description>.html). This convention remained uniform across all identified phishing pages, spanning over 267 known templates.

The alphabetical prefix serves as a functional indicator of the victim’s current stage within the phishing cycle. For instance, pages bearing the prefix “a” represent the initial stage of the attack chain, where victims are typically presented with lures designed to invoke a sense of urgency. Common themes observed at this stage include loyalty points expiration notices, undelivered package fee demands, government-issued fines, and toll collection fees.

Beyond its structural role, the naming convention also functions as an operational guide for affiliates. With over 267 templates available within the kit, this prefix system provides a standardized framework that allows affiliates to easily navigate the phishing workflow and understand the number of steps involved in completing a full phishing cycle.

This demonstrates a deliberate effort to lower the technical barrier for affiliates, streamlining the execution of phishing campaigns at scale.

The following table summarizes the page structures identified within the Outsider Phishing Kit.

This pattern could also be seen in a showcase from the threat actor’s Telegram channel on setting up a phishing page.

Figure 9. Example of setting up the phishing page.

File tree analysis

Further analysis into the phishing website structure will be available in an upcoming research titled “Smish. Click. Drained. Inside the Smishing Triad’s Phishing Cockpit ”.

All identified phishing websites contain javascripts and files which are delivered throgh API:

common.js

The JavaScript file common.js is the campaign configuration file that sets up the look, feel, and specific target of the phishing kit.

• Campaign Identity (projectName): Defines a specific template identifier string. This allows the threat actor to organize and deploy specialized phishing variations depending on the regional entity they are actively impersonating.
• The Exit Strategy (errorJumpAddress): Specifies a legitimate, high-profile corporate URL. Once the data-harvesting process is complete, the kit silently redirects the victim to this authentic website to make the entire interaction appear as a minor system glitch, successfully minimizing immediate suspicion.
• Visual Deception (loadinglayerStyles / Font): Defines the exact hex color codes and loading messages used by the overlay templates. This ensures that fake loading loops perfectly match the color palettes of the brand being impersonated.
• Persistent Session Tracking (jwr_storage): A robust data storage utility that manages the victim’s unique tracker ID across browser tabs. It automatically attempts to use localStorage and seamlessly falls back to sessionStorage if the user is in an Incognito or Private browsing window, ensuring the actor maintains continuous real-time tracking as the victim navigates the fraudulent pages.

Below is a look at the “common.js” from analyzing the phishing website example above impersonating Singapore’s LTA contains the phishing template name “SG” and “SG-ETC”.

The Keys used in the cfg dictionary are consistent throughout the identified templates, acting as a signature to detect pages.

main.js

The JavaScript file main.js is a highly sophisticated, obfuscated front-end tracking system designed to steal sensitive user information, specifically credit card details (including CVV), bank logins, PayPal account credentials, and two-factor authentication (2FA) tokens. It monitors what a user is typing in real-time, encrypts the stolen data, and transmits it back to a command-and-control server.

Key Functionalities

• Real-Time Data Theft (Keylogging & Form Sniffing)

The core data structure in the script is _0x449988 (aliased as cvvform). It defines placeholders to continuously scrape virtually every form of critical financial and identity data from the webpage:

• Credit Card Data: Card number, holder name, expiration date, CVV, and PIN.
• Account Logins: Website login accounts/passwords, bank portal credentials, and PayPal login strings.
• Personal Identity: First/last name, phone number, physical address, email addresses, Date of Birth, and Social Security Numbers (SSN).
• Security Bypass Elements: Fields to catch SMS verification codes, 2FA prompt characters, and custom validation errors.

• End-to-End Encryption (JwrCrypto)

To avoid detection by basic network firewalls and automated security tools, all communications are securely packaged:

• Uses the browser’s native Web Crypto API (crypto.subtle) for security.
• Encrypts information payloads utilizing AES-CTR (Counter Mode) with dynamically generated random 256-bit encryption keys and 128-bit initialization counters.

• Dynamic Command & Control Interaction (WebSockets & Web Workers)

The software does not just blindly send data out. It maintains a live, two-way interaction pipeline via a persistent connection:

• Spawns a hidden background processing instance through a distinct file called ws-worker.js.
• Establishes a WebSocket connection (ws:// or wss://) using a randomized tracking string (JWRCID).
• Live Directing: It actively polls for instructions from a remote actor. The attacker can push actions in real-time to manipulate what the victim sees (e.g., triggering loading popups, displaying fake validation alerts, or requesting a different credit card via tip_change_card).

• Advanced Persistence & Environment Detection

• Anti-Debugging Safeguards: Employs a defensive trap function (_0x9ca413) that drops an infinite recursion loop via complex regular expressions (“(((.+)+)+)+$”) to freeze the browser tab if an analyst attempts to view or format (toString) the runtime script.
• Tracking Focus: Implements automated event hooks via visibilitychange to report user activity if the target tab switches focus.
• Platform Adaptability: Adapts dynamically to steal data out of native checkout applications including WooCommerce (WordPress), Shopify, and Shopyy template frameworks.
• Device Profiling: Pulls localized data elements from external services (like ipinfo.io or ip-api.com) to register the targeted machine’s true IP address, country tracking flags, and geometric coordinates.

check.js

The Javascript file check.js is an input-validation and auto-formatting utility partially obfuscated using obfuscator.io. It acts as a client-side form-validity checker, enforcing strict format and length rules on input fields via a live runtime loop, and dynamically locking target form buttons until all criteria are met.

• Financial Validation: It performs basic length and issuer-prefix checks on credit card numbers, validates expiration dates against the current system year/month, and checks CVV length.
• Identity Harvesting: It features dedicated regular expression validators for high-value global national identifiers, including: United States (SSN), United Kingdom (NINO), Canada (SIN), Australia (TFN), Germany (ID), France (INSEE), Italy (Codice Fiscale), Spain (DNI), the Netherlands (BSN), Sweden (Personnummer), Norway (Fødselsnummer), and Denmark (CPR).
• Anti-Analysis: The script begins with a specialized anti-debugging trap utilizing regular expression backtracking designed to freeze browser developer tools upon code formatting or inspection.

GetSyncSetting

GetSyncSettings is the real-time configuration profile (the “brain”) sent from the attacker’s command-and-control (C2) server to control the phishing website.

Core Functions

• Victim Control & Deception: It forces the website to display credit card forms and fake PayPal portals simultaneously (show_card and show_paypal). It also activates a trigger (two_card_switch) that falsely rejects the victim’s first card, tricking them into providing input for a second one.
• Evasion & Filtering: It blocks security crawlers (bot_blocked) and bans specific types of test credit cards (bin_blacklist) to prevent security researchers from analyzing the system.
• Live Attacker Audio Alerts: It instructs the attacker’s dashboard to play live sounds (voice_reminders) whenever a victim interacts with the page, such as typing an address, entering a password, or submitting a card.

Filename “GetSyncSetting” is unique to Outsider’s phishing websites and can be used to attribute the phishing pages. Before Operation GhostHook, Group-IB specialists had identified more than 10,000 unique domains associated with the Outsider phishing kit. Despite the international crackdown, Group-IB have continued to track the threat and have identified more than 700 additional unique domains, demonstrating that the operation remains active and resilient.

Telegram Channel Showcase

Although this Telegram channel has since been deleted by ChenLun to remain hidden from law enforcement, this section of the blog showcases the ecosystem of ChenLun before the takedown was carried out.

Prior to Operation Ghost Hook, the Outsider Phishing kit was being sold on Telegram. The Telegram ecosystem consists of a channel where Chenlun disseminates updates or changes to the kit, a subscriber only group for affiliates who purchased the kit, a public group for discussion and a Telegram bot to make purchases and answer frequently asked questions.

The main group had more than 5,000 common subscribers and more than 230 active users who had bought the kit, before it was suspended.

Figure 11. ChenLun’s Outsider telegram ecosystem showcasing active users before being taken down.

Utilizing the previous Outsider’s Telegram bot, Group-IB researchers identified the following template categories provided to affiliates.

• Financial Securities templates (证劵类)
• Points expiry (积分类)
• Postal / Shipment payments (包裹类)
• Fines (罚单类)
• Electronic Toll Collection (ETC类)
• Shopify (电商插件)
• WordPress Payment Page (电商支付插件)
• Apple ID (苹果ID类)

Among the 267 templates, Group-IB researchers have identified the following main industries mimicked:

• Financial Services
• Brokerage Services
• Telecommunications Services
• Postal / Shipping Services
• Government and Toll Services

Outsider Phishing Panel Showcase

The Outsider Phishing Panel enables affiliates to manage and orchestrate phishing campaigns through a centralized, web-based interface. The panel offers a range of features designed to streamline campaign deployment and victim management, including:

• Phishing page creation: Affiliates can deploy phishing campaigns using a library of 267 pre-built templates, with the ability to customize and modify pages as needed.
• Real-time victim management: Victims interacting with phishing pages can be redirected to attacker-defined endpoints, enabling the collection of credentials, payment information, and other sensitive data.
• Centralized dashboard: The panel provides real-time visibility into campaign activity, including phishing page visits, victim interactions, and harvested data.
• Centralized data storage: Information captured during phishing campaigns is consolidated within the panel, allowing affiliates to review and manage stolen data from a single interface.

The following section showcases Outsider Phishing Panel, based on demonstrations previously shared by ChenLun on Telegram while the service was actively being promoted.

Page 1: The home panel displays real-time statistics, including today’s visits, total visitors, cards stolen today, total cards stolen, and a world map visualizing the geographic distribution of victims.

Figure 14: Outsider phishing panel showcase (1).

Page 2: Campaign setup. Affiliates can select from 220 template options to initiate their phishing campaigns.

Figure 15: Outsider phishing panel showcase (2).

Page 3: After selecting a template, affiliates can customize which pages to edit, following the naming conventions described earlier (<alphabet>_<description>).

Figure 16: Outsider phishing panel showcase (3).

Page 4: Customization page is split into 3 sections.

• Left: Preset templates available for selection.
• Middle: Live preview showing how victims will see the edit page.
• Right: Manual editing tools for detailed customizations.

Figure 17: Outsider phishing panel showcase (4).

Page 5: Demonstrates the ease of editing content without coding knowledge. Affiliates can effortlessly update reward items to display current offerings, increasing victim engagement and likelihood of completing the phishing flow.

Figure 18: Outsider phishing panel showcase (5).

Page 6: Once configured successfully, affiliates can view and manage all their phishing pages from a centralized dashboard.

Figure 19: Outsider phishing panel showcase (6).

Page 7: Showcases live data interception. Details are captured instantly as victims enter information, ensuring the affiliate obtains data even if the victim abandons the form before submission. The data can be accessed even after the victim has left the site.

Figure 20: Outsider phishing panel showcase (7).

Page 8: Affiliates can configure and execute man-in-the-middle attacks to redirect victims to secondary verification pages. The verification methods presented to victims (SMS, email, PIN, or app) are determined by the affiliate’s configuration settings.

Page 9: Showcase of SMS OTP verification and live data interception.

Figure 22: Outsider phishing panel showcase (9).

Conclusion

The Outsider Phishing Kit represents a significant marker in the evolution of phishing-as-a-service ecosystems. What was once a technically demanding operation has been reduced to a subscription and a Telegram channel. Despite law enforcement and platform takedown efforts through Operation Ghost Hook, affiliates continue to actively use the kit and create new campaigns. Organizations and individuals must remain vigilant as the threat persists. Group-IB continues to monitor this threat and will provide updates as the situation develops.

Recommendations

For Enterprises:

• Track new pages utilizing the unique file name signatures to initiate takedown of phishing sites
• Integrate our Threat Intelligence solution to identify emerging phishing kits early
• Implement continuous monitoring for SMS-linked brand abuse with a comprehensive Digital Risk Protection solution.

For individual users:

• Be cautious of unsolicited SMS messages creating urgency.
• Avoid clicking links in SMS notifications.
• Verify alerts through official apps or websites.
• Never provide sensitive or payment information via SMS links.

MITRE ATT&CK

DISCLAIMER: All technical information, including malware analysis, indicators of compromise and infrastructure details provided in this publication, is shared solely for defensive cybersecurity and research purposes. Group-IB does not endorse or permit any unauthorized or offensive use of the information contained herein. The data and conclusions represent Group-IB’s analytical assessment based on available evidence and are intended to help organizations detect, prevent, and respond to cyber threats.

Group-IB expressly disclaims liability for any misuse of the information provided. Organizations and readers are encouraged to apply this intelligence responsibly and in compliance with all applicable laws and regulations.

This blog may reference legitimate third-party services such as Telegram and others, solely to illustrate cases where threat actors have abused or misused these platforms.

This material is provided for informational purposes, prepared by Group-IB as part of its own analytical investigation, and reflects recently identified threat activity.

All trademarks referenced herein are the property of their respective owners and are used solely for informational purposes, without any implication of affiliation or sponsorship.