Researchers at Push Security have analyzed a phishing platform used by organized criminal threat actors like ShinyHunters and BlackFile, finding more than 400 domains linked to attacks launched by the phishing kit.

“Since at least August 2025, attackers have been running hybrid social engineering campaigns targeting hundreds of organizations across financial services, technology, cryptocurrency, healthcare, hospitality, and private aviation,” the researchers write. “The attacks combine voice phishing with MFA-bypassing adversary-in-the-middle (AiTM) phishing mechanisms that allow the attacker to steal authenticated sessions for target applications — typically enterprise identity providers and cryptocurrency exchanges. Once an identity provider account is compromised, the attackers pivot across connected SaaS platforms — SharePoint, Salesforce, DocuSign, Slack — exfiltrate data, and attempt to extort the victim organization. “

Notably, the researchers have observed several forks based on the original phishing kit. Some of the forks rely heavily on AI-generated code, suggesting that inexperienced threat actors are developing capabilities above their skill levels.

“The existence of these independently branded forks indicates that the tooling has entered a phase of wider distribution — operators who obtained the original panel source are now customizing and reshipping it for their own purposes,” Push Security says. “As a result, the tooling is now most likely accessible to a broad population of financially motivated threat actors.”

Attackers are always coming up with ways to bypass technical defenses and target humans directly with social engineering attacks.

“The phone call as delivery vector eliminates the email-based detection surface that most organizations rely on as their primary phishing defense,” the researchers write. “Operator-gated payload delivery further reduces the likelihood that these sites will be flagged as malicious and added to known-bad detection lists (and in any case, it’s trivial for attackers to spin up new ones).”

Push Security has the story: We infiltrated a criminal phishing panel: here’s what we found