A phishing platform dubbed ZeroTokens allows attackers live visibility into victim sessions and the ability to change subsequent prompts in real time, allowing attacks to adapt in real time while targeting credentials and financial information.
The platform allowed an operator to monitor information entered by victims and steer individual phishing flows while separately using the harvested data against the genuine institution.
Abnormal AI published its analysis of the campaign on August 25. It found that more than 45,000 messages were sent to over 24,000 recipients across more than 700 organizations. Some 24,000 messages were sent on a single peak day, according to the research.
Live Operators Control Each Phishing Session
The campaign used ten sender domains and nine abused SendGrid accounts. Messages passed SPF, DKIM and DMARC checks and used W-8BEN tax-documentation reviews as a believable pretext for recipients with US securities holdings.
The phishing site reproduced the targeted financial institution and could present up to eight stages modeled on its verification process. As victims entered information, ZeroTokens reported the session state to its platform and allowed an operator to choose which screen appeared next.
The observed flow collected login credentials, driver’s license and card details, SMS verification codes, app-based approvals and a separate trading password. A persistent WebSocket connection relayed the victim's inputs to the operator console while allowing the operator to control the session.
The operator could also respond to failed verification attempts by showing another prompt, keeping the interaction active rather than allowing the phishing session to end. Once collection was complete, the victim could be redirected to the legitimate institution's website.
Read more on real-time phishing: Okta Flags Customized, Reactive Vishing Attacks Which Bypass MFA
Scale Suggests In-House Criminal Operation
ZeroTokens supported 53 financial institutions and 36 card-issuer templates, covering banks and brokerages in multiple regions.
Abnormal AI found the tool's console had separate super-admin and operator roles, leading researchers to assess with high confidence that it was likely in-house tooling for a single group rather than a rented phishing-as-a-service (PaaS) offering.
The platform itself did not provide functionality for withdrawals, transfers, payee changes or trading orders. Abnormal therefore assessed that financial theft or payment redirection would most likely occur outside the platform using information collected during the phishing interaction, rather than through ZeroTokens itself.