Full Report
This blog provides a deep-dive into the phishing kit created by Chenlun known as the Outsider Phishing Kit. It is a well established kit in the Chinese community with over 267 ready-made phishing templates targeting over 54 countries worldwide.
Analysis Summary
# Tool/Technique: Outsider Phishing Kit
## Overview
The Outsider Phishing Kit is a highly sophisticated, commercially available phishing framework created by a developer known as **Chenlun**. It is widely utilized within the Chinese-speaking cybercrime community and is designed to facilitate large-scale, automated phishing campaigns. The kit is notable for its modularity, featuring over 267 ready-made templates that target organizations across 54 countries, ranging from financial institutions to logistics and government portals.
## Technical Details
- **Type:** Phishing Kit / Framework
- **Platform:** Web-based (Cross-platform targets via Browser)
- **Capabilities:** Real-time victim interaction, anti-analysis, multi-layered evasion, and automated credential exfiltration.
- **First Seen:** Approximately 2023 (Established presence in Chinese community).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0005 - Defense Evasion]**
- [T1027.013 - Obfuscated Files or Information: Encrypted/Encoded Payload]
- [T1622 - Debugger Evasion]
- [T1497 - Virtualization/Sandbox Evasion]
- **[TA0007 - Discovery]**
- [T1217 - Browser Information Discovery]
- [T1614 - System Location Discovery]
- **[TA0009 - Collection]**
- [T1056.003 - Input Capture: Web Portal Capture]
- [T1119 - Automated Collection]
- **[TA0011 - Command and Control]**
- [T1071.001 - Web Protocols: Application Layer Protocol]
- [T1095 - Non-Application Layer Protocol (WebSockets)]
- [T1573.001 - Symmetric Cryptography]
## Functionality
### Core Capabilities
- **Mass Template Library:** Contains 267+ templates for global brands, banks, and government services.
- **Real-time Data Streaming:** Uses WebSockets to stream victim keystrokes and form data to the attacker's dashboard instantly (`synchronousDataInputHandle`).
- **Dynamic Geolocation:** Rotates through four different IP geolocation providers to identify victim location and bypass region-locking.
- **Device Fingerprinting:** The `getDeviceInfo()` function collects User-Agent, browser, and OS details to serve optimized phishing pages.
### Advanced Features
- **Sophisticated Encryption:** Implements AES-256-CTR encryption for C2 traffic, with the key prepended in-band for each session.
- **Anti-Analysis/Debugger Evasion:** Includes integrity probes and worker-based anti-debugging scripts to detect if the page is being inspected by a researcher.
- **Stealth WebSocket Communication:** Uses binary WebSocket frames to bypass simple keyword-based network filters.
- **Visibility Tracking:** Tracks the victim's "focus" state on the browser tab to notify the attacker when the victim is actively viewing the page.
## Indicators of Compromise
- **File Names:** `worker.js`, `core.js`, `api/open/*` (Common directory structures).
- **Network Indicators:**
- Communications typically occur over encrypted WebSockets (`ws://` or `wss://`).
- Heavy use of Cloudflare-fronted domains to hide backend infrastructure.
- C2 Endpoints: `[domain]/api/open/` (Example path).
- **Behavioral Indicators:**
- Continuous outgoing WebSocket traffic originating from a web form before the "Submit" button is clicked.
- Repeated calls to multiple geolocation APIs within a single session.
## Associated Threat Actors
- **Chenlun** (Developer/Distributor)
- Various unidentified Chinese-speaking cybercrime affiliates.
## Detection Methods
- **Behavioral Detection:** Monitor for "live-typing" behavior where data is sent to a third-party domain asynchronously as a user fills out a form.
- **Network Analysis:** Identify and flag binary WebSocket frames originating from suspicious or newly registered domains (NRDs).
- **Signature-based:** Detect the specific Vue.js implementation and the `getDeviceInfo` / `synchronousDataInputHandle` function signatures in obfuscated JavaScript files.
## Mitigation Strategies
- **Prevention Measures:**
- Implement FIDO2-compliant hardware security keys (MFA) to prevent credential replay, as the kit can capture TOTP codes in real-time.
- Deploy URL filtering and protective DNS to block known phishing domains.
- **Hardening:**
- Use Content Security Policy (CSP) headers to restrict where form data can be sent and which scripts can execute.
- Educate users on identifying typosquatted domains and suspicious URL structures.
## Related Tools/Techniques
- **EvilProxy / NGINX Phishing:** Similar "Man-in-the-Middle" (AiTM) capabilities.
- **Telekopye:** While different in platform, it shares the "kit-as-a-service" and massive template library philosophy.