<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-phishing-kit-artifacts
description: >-
  Reverse-engineer and analyze phishing kit source code, credential
  harvesting mechanisms, exfiltration channels, evasion techniques, and
  embedded threat actor fingerprints for attribution and detection.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - phishing-kit
  - kit-analysis
  - credential-harvesting
  - exfiltration
  - reverse-engineering
  - threat-intelligence
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566"]
---

# Analyzing Phishing Kit Artifacts

## Overview

Phishing kits are packaged toolsets deployed by threat actors to create
credential harvesting pages. Analyzing recovered kits reveals exfiltration
methods (email, Telegram, dead drops), evasion code (bot detection, IP
blocking), actor fingerprints (email addresses, Telegram handles), and
reusable detection signatures.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| Isolated analysis VM | Never analyze kits on production systems |
| `unzip` / `7z` | Archive extraction |
| `grep` / `rg` | Pattern searching |
| `file` | File type identification |

## Key Concepts

### Common Phishing Kit Components

```
phishing-kit/
├── index.php          ← Landing page with credential form
├── post.php           ← Credential handler and exfiltration
├── .htaccess          ← Bot blocking, IP filtering
├── antibot.php        ← Crawler/scanner detection
├── css/               ← Cloned brand styling
├── images/            ← Cloned brand assets
└── js/                ← Form validation, obfuscation
```

### Exfiltration Methods

| Method | Code Pattern | Description |
|---|---|---|
| Email | `mail()`, `smtp` | Stolen creds sent to actor email |
| Telegram | `api.telegram.org/bot` | Exfil to Telegram bot |
| Dead drop | `file_put_contents()` | Saved to remote server file |
| Firebase | `firebaseio.com` | Cloud database exfiltration |
| Discord webhook | `discord.com/api/webhooks` | Exfil to Discord channel |

### MITRE ATT&CK Mapping

| Technique | ID | Description |
|---|---|---|
| Stage Capabilities: Upload Tool | T1608.005 | Deploy phishing kit |
| Credential Access: Input Capture | T1056.003 | Web portal capture |
| Exfiltration Over Web Service | T1567 | Telegram/Discord exfil |

## Workflow

### 1. Safe Extraction

```bash
mkdir /tmp/kit_analysis && cd /tmp/kit_analysis
unzip -o /tmp/recovered_kit.zip -d ./kit_contents/
find ./kit_contents/ -type f | sort
```

### 2. Code Analysis

```bash
node agent.js scan-kit --kit-dir /tmp/kit_analysis/kit_contents/
node agent.js extract-actor-iocs --kit-dir /tmp/kit_analysis/kit_contents/
node agent.js analyze-evasion --kit-dir /tmp/kit_analysis/kit_contents/
```

### 3. IOC Extraction

```bash
node agent.js extract-iocs --kit-dir /tmp/kit_analysis/kit_contents/
node agent.js generate-yara --kit-dir /tmp/kit_analysis/kit_contents/ \
  --rule-name "PhishKit_ActorX"
```

### 4. Reporting

```bash
node agent.js generate-report --kit-dir /tmp/kit_analysis/kit_contents/ \
  --output /tmp/kit_report.json
```

## Detection

```yaml
title: Phishing Kit Artifacts Detection
id: 6e29d755-7692-4a56-a651-e5bcfe3d4d7d
status: experimental
description: Detects suspicious activity related to analyzing phishing kit artifacts techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1566
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| Kit safely extracted | Files in isolated environment |
| Exfil method identified | Email, Telegram, or dead drop found |
| Actor IOCs extracted | Emails, handles, tokens collected |
| Evasion code analyzed | Antibot, IP blocking documented |
| YARA rule generated | Rule matches kit fingerprint |

## References

- [MITRE ATT&CK T1608.005 — Link Target](https://attack.mitre.org/techniques/T1608/005/)
- [PhishTank Database](https://phishtank.org/)
- [OpenPhish Intelligence](https://openphish.com/)
