Malte ZanderContents
A phishing kit is a ready-made package that turns any web server into a copy of a brand's login or payment page, including the code that passes stolen data to the criminal. Phishing-as-a-service platforms rent these kits by subscription, with hosting and real-time tools included. Kits make phishing scale, but they also leave repeating traces that link many fake sites to one actor and speed up takedowns.
- LabHost, dismantled by police in April 2024, offered a menu of more than 170 fake website templates (The Record).
- Investigators linked at least 40,000 phishing domains and about 10,000 users to LabHost. Its users stole about 480,000 card numbers, 64,000 PINs and one million passwords (BleepingComputer).
- Microsoft traced adversary-in-the-middle campaigns against more than 10,000 organizations to the open-source kit Evilginx2 (Microsoft).
What is a phishing kit?
A bundle of files that recreates a brand's page and collects whatever victims type into it. The criminal uploads the kit to a rented server or a hacked website, points a domain at it and sends out the link.
The kit is the reason the same fake appears on dozens of domains: building the page once is enough.
What does a phishing kit contain?
| Component | What it does |
|---|---|
| Page templates | Copies of the brand's login, payment or verification pages, with logos, styles and texts |
| Form handler | Receives credentials, one-time codes or card data |
| Data exfiltration | Passes the stolen data on, to an email address, a messaging bot or an admin panel |
| Anti-detection | Blocks security scanners and certain countries, or shows the fake only with the right link |
| Admin panel | Lists captured data, sometimes in real time |
| Real-time module | Asks the victim for a one-time code while the attacker logs in with it |
The real-time module is what defeats one-time codes. Read why two-factor login doesn't stop every phishing page.
How does phishing-as-a-service work?
Like any software subscription. The platform provides templates, hosting, tools to send lures and a dashboard, and the customer pays monthly.
LabHost shows the model. It charged an average of $249 a month, ran on the open web and offered a campaign tool called LabRat that let criminals watch and steer attacks live and capture two-factor codes (BleepingComputer, The Record). Police in 19 countries searched 70 addresses and arrested 37 suspects in April 2024.
The effect for brands: the barrier to attack drops to a subscription fee, and AI tools now lower it further. See AI-built phishing sites.
Why do kits matter for brand owners?
One template, many domains. Taking down one site rarely ends the campaign.
Kits keep up. When you redesign your login page, the kits follow.
Real-time kits defeat one-time codes, which shifts the protection to phishing-resistant login methods.
Which traces do phishing kits leave?
The same ones over and over, because criminals reuse what works:
Identical files and structure: the same file names, paths and page code across many sites.
Leftover archives and open directories on the server, where the kit was unpacked.
Shared infrastructure: the same host, IP ranges, name servers or certificates.
Your own files: some kits still load images or scripts from your servers.
The same data endpoint: many sites sending stolen data to one place.
The same lures: identical email templates, link shorteners or QR code designs.
How do you use kit traces against a campaign?
Link the cases. Group fake sites by shared traces instead of handling each one alone. Our guide on linking cases shows how.
Report the campaign, not the single site. List all related URLs in your reports. ICANN's guidance expects registrars to also review information they can access, such as name servers, account data and the reported page (ICANN), so related domains under one account can fall together.
Document what you see. Note leftover archives and open directories in your evidence, and leave the analysis of the files to security specialists.
Watch for redeployments of the same template on new domains. See the resurfacing problem.
Can police stop phishing kit platforms?
Sometimes, and it helps. The LabHost operation took down the platform and its infrastructure. Australian police alone removed 207 servers hosting LabHost sites (BleepingComputer).
But new platforms fill the gap, and the kits already sold keep working. For brands, takedowns of individual sites remain the daily work.
Start the free fraud scan and get a short report on lookalike domains and cloned pages within 48 hours.
FAQ
What is the difference between a phishing kit and phishing-as-a-service?
A phishing kit is the software. Phishing-as-a-service rents the kit together with hosting, tools to send lures, a dashboard and updates, usually as a monthly subscription.
Is using a phishing kit illegal?
Using one to collect other people's credentials is fraud in practically every jurisdiction. Selling and hosting kits usually is too. This is not legal advice.
Can a phishing kit be detected before it goes live?
Sometimes. New lookalike domains, fresh certificates and test deployments that load your files can appear before the first lure goes out.
Why does the same fake site keep coming back?
Because redeploying a kit on a new domain takes minutes. Monitoring closed cases and reporting related domains together breaks that cycle.
Sources
The Record: LabHost shut down in global operation, 18 April 2024
BleepingComputer: LabHost phishing service disrupted, 18 April 2024
Microsoft Security: AiTM phishing sites as entry point to financial fraud, 12 July 2022
ICANN advisory: DNS abuse obligations, 5 February 2024