Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-10 · high
The kits reuse near-identical code and lean on mainstream messaging apps to move stolen credentials, per a review of 1,300 samples from 2020-2023.
Why now: The kit analysis is part of the August 10 coverage, examining phishing kits collected through 2023.
A review of 1,300 phishing kits found 284 shipped with zero evasion functionality, per an analysis of kits collected between 2020 and 2023.
That's 21.8% of the sample with no attempt to dodge detection, in a category security teams tend to treat as endlessly adaptive.
The kits also lean on mainstream messaging services to move stolen credentials out, rather than building custom exfiltration infrastructure, per the analysis.
Components inside the kits are close to identical too, kit after kit, per the analysis. The analysis doesn't say whether that overlap comes from shared source kits or copied code circulating after leaks.
Phishing's reputation for constant reinvention doesn't match this sample. If the code and exfiltration channels are really this concentrated, targeting the messaging-app funnel could catch more than chasing kit variants one at a time. Watch whether takedown efforts start going after the messaging-service side instead.
This analysis made the August 10 briefing, examining phishing kits collected through 2023.
Each link below shares sources, entities, or timing with this story.
Shared entity: Analysis / Same source domain / Earlier coverage / Tension
Both cover Analysis; reported by the same outlet (arxiv.org); earlier Analysis coverage from 2026-08-07.
Shared entity: Analysis / Same source domain / Earlier coverage
Both cover Analysis; reported by the same outlet (arxiv.org); earlier Analysis coverage from 2026-08-03.
Same source domain / Shared topic / Tension
Reported by the same outlet (arxiv.org); overlapping topics (detection, found); pushes against this story (but).
Shared entity: Analysis / Earlier coverage / Downstream implication
Both cover Analysis; earlier Analysis coverage from 2026-03-19; traces where this leads (implication).
Shared entity: Analysis / Earlier coverage / Tension
Both cover Analysis; earlier Analysis coverage from 2026-03-15; pushes against this story (versus).
Same source domain / Shared topic
Reported by the same outlet (arxiv.org); overlapping topics (detection, found).
Reported by the same outlet (arxiv.org); overlapping topics (component, found).
Reported by the same outlet (arxiv.org); overlapping topics (credential, found).