Phishing Kit

A phishing kit is a pre-built package of files and scripts — small programs that automatically carry out a specific task — containing everything needed to run a fake website. This website looks deceptively genuine: for example, it imitates the login page of a bank, an email provider, or an online shop. Anyone who enters their username and password there sends that data directly to the attackers. The crucial point is that the kit is already built. It is purchased on the dark web — a part of the internet that cannot be reached with normal browsers — and set up on a rented server, often within minutes.

Phishing as a mass-produced commodity

In the past, anyone wanting to run a phishing site had to be able to program it themselves. Phishing kits have changed that. They lower the technical barrier to entry so far that practically anyone can become an attacker. This is why phishing is now one of the most common forms of internet crime.

At the same time, an entire market has sprung up around these kits. Some developers sell them as one-off purchases, others rent them out on subscription — a business model reminiscent of legitimate software. Some kits even contain a backdoor: the original developer automatically receives a copy of every stolen credential, without the kit’s buyer noticing.

Structure and operation of a kit

A typical phishing kit consists of three parts. The first part is the fake webpage itself: HTML files and images that replicate the look of a genuine site, often simply copied straight from the original. The second part is a script that intercepts the entered data and forwards it to an email address or a Telegram channel controlled by the attackers. The third part consists of helper files designed to bypass security mechanisms — for example, filters that block known phishing sites.

More modern kits go even further. They can carry out so-called real-time attacks: when the victim enters their credentials, the kit immediately logs into the real service with them and also intercepts the second security code — the number sent via SMS. This allows it to bypass two-factor authentication, a protective mechanism that is actually meant to prevent exactly this kind of attack.

The finished fake page ultimately needs a credible address. Attackers therefore register domains that resemble the real one — for instance, “paypa1.com” instead of “paypal.com” — and then send out mass emails to lure users to this site.

Phishing kits in the media, security reports, and everyday life

Security researchers regularly discover new kits and analyze them publicly. Companies such as Google, Microsoft, or Cloudflare publish annual reports listing the most frequently abused brands — large banks, parcel delivery services, and streaming providers are almost always at the top, since they have especially many users and are therefore particularly rewarding targets.

In everyday life, one encounters the results of such kits even without knowing the term itself: the supposed DHL text message with a parcel link, the fake Netflix email about an allegedly expired payment, or the deceptively genuine-looking savings bank page that a search ad leads to. All of these are often not custom-built attacks, but off-the-shelf kits.

For the IT security industry, phishing kits are also an object of research: because every kit leaves behind certain patterns — such as characteristic file names or code structures — analysts can use them to attribute different waves of attacks to one and the same developer, much like a detective recognizing a handwriting style.