Phishing Wave Advisory — Recent Fake-Mirror Campaigns Under Analysis

The darknet ecosystem has always been a game of mirrors – and lately, the mirrors are winning. For researchers tracking market uptime and vendor trust, the last several weeks have delivered a sobering reminder that the most sophisticated threat isn’t a compromised escrow or an exit scam, but the humble phishing page. A fresh wave of fake-mirror campaigns and credential-harvesting operations is making the rounds, and the techniques being deployed are bleeding over from mainstream corporate attacks into the underground with alarming speed.

If you are actively monitoring onion services or researching threat actor infrastructure, here is a technical breakdown of what is being observed, how the attack chains work, and how to keep your research operations from becoming a case study in OPSEC failure.

The Shifting Landscape of Credential Harvesting

Historically, darknet market phishing was a low-effort grind: clone a login page, host it on a similar-looking .onion, and blast links through forum DMs. While that baseline still exists, the current wave borrows heavily from enterprise-grade phishing kits that prioritize evasion and real-time relay tactics.

Recent analysis of phishing-as-a-service (PhaaS) kits targeting US organizations reveals a disturbing leap in sophistication. These kits are no longer just static credential stealers; they function as sophisticated reverse-proxy relays. The attack chain detailed by researchers at Sekoia shows a multi-stage process that begins with a lure-often a PDF titled something like “Final Lien Waiver.pdf”-delivered via email or QR code. The traffic passes through an open-redirect step before landing on a Cloudflare Turnstile gate disguised as a benign “Gourmet Delights” food page. This is a crucial development: the challenge gate blocks automated scanners and sandboxes from ever reaching the phishing content, ensuring that only humans proceed.

IP-based filtering silently redirects data-center, VPN, and proxy IPs to a benign Wikipedia page, ensuring that security researchers using automated tools or commercial VPNs see nothing but a dead end. Genuine victims, however, are presented with a pixel-accurate cloned Microsoft authentication page. The server autofills the victim’s email from a URL parameter, and the credentials are POSTed to a backend that relays them live to Microsoft’s actual authentication API. The victim completes real MFA (Authenticator push, OTP, or SMS) against the genuine backend, and the resulting session cookie is captured server-side and handed to the attacker. This is not a simple credential harvest; it is a full account takeover conducted in real-time.

For darknet market researchers, the implication is clear: if you are logging into a clearnet forum or a market’s associated email provider and you are not using a dedicated, hardened browser profile, you are vulnerable to these AiTM (adversary-in-the-middle) tactics. The PhaaS kits even hardcode distinct User-Agent strings for each step of the authentication flow (e.g., Safari-on-iOS for login, Chrome-on-Windows for MFA resolution) to bypass behavioral detection, creating a detectable but subtle “impossible device shift” in the logs providers see.

Why Fake Mirrors Are Getting Harder to Spot

Legitimate market mirrors have always been a vector for this, but the difficulty is compounded by a general attack on trust at the infrastructure level. We are seeing a wave of lures that don’t just target the end-user; they target the way we authenticate our identities across services.

Consider the recent attacks on Okta infrastructure. Analysts observed a two-stage phishing process that leverages JavaScript-based credential harvesting. Attackers proxy legitimate Okta pages while injecting malicious code that captures usernames and monitors for session cookies. The malicious script hooks the window.fetch method, redirecting all legitimate requests from Okta back to the attacker’s phishing domain. For victims using Okta as their identity provider for other services, this is catastrophic. This level of sophistication-monitoring for cookies like JSESSIONID or sid every second and exfiltrating them-demonstrates that session hijacking is far more prevalent than simple password theft. If a darknet operator or moderator uses federated logins through enterprise portals, they are squarely in the crosshairs of these non-market-specific campaigns.

The New Wave of Distraction: SEO and Fake Updates

While AiTM relays are the heavy hitters, the volume of the current phishing wave is being driven by creative distribution channels that bypass the traditional email-to-market pipeline. We are seeing a significant uptick in campaigns that use SEO poisoning and hidden HTML to lure targets looking for technical fixes or software downloads.

Security researchers at Zscaler identified a campaign that disguised itself as documentation for a Python library called requests-secure-v2. The pages were stuffed with keyword-heavy text to surface near the top of search results for developers troubleshooting code. Inside, hidden instructions in the JSON-LD structured data format-normally used to help search engines understand content-were used to frame a fake developer license fee as a routine step. This effectively manipulated AI agents and automated crawlers into completing a cryptocurrency payment to a wallet controlled by the attacker. A second campaign typosquatted DeBank, a decentralized finance tracker, using a lookalike domain to harvest login credentials. For researchers on the darknet analyzing crypto movements or tracking ransomware payments, a simple typo in a domain search can now lead to compromised search histories or worse.

Simultaneously, the SMOKE#SCREEN campaign, detailed by Securonix, shows the endpoint risk. This multi-wave campaign uses social engineering lures themed around Adobe and Zoom software updates to install ConnectWise ScreenConnect-a legitimate Remote Monitoring and Management (RMM) tool-on Windows systems. The goal is persistent, operator-level remote access. For someone maintaining a secure research workspace, a fake “update” alert, even coming from a plausible source like a compromised vendor chat, can install a tool that runs with legitimate privileges and bypasses endpoint detection entirely. The persistence of such an RMM implant is the core threat-it grants the same level of control a legitimate IT administrator would have, and it is rarely flagged by security tools.

Mainstream Tactics, Darknet Targets

These aren’t just corporate threats. The darknet market space is a prime target because users are conditioned to enter credentials on cloned pages quickly, and the high value of a compromised vendor or moderator account justifies the effort of these complex attacks. The phishing infrastructure is often hosted on legitimate cloud services-recent campaigns used compromised AWS S3 buckets to host redirects-making allow-listing nearly impossible.

We are also seeing a rise in timing-based social engineering. A critical alert from cybersecurity researchers highlighted a phishing campaign targeting LastPass users that commenced on January 19, 2026, deliberately launching over the U.S. holiday weekend. The malicious actors impersonated support staff, sent fraudulent emails claiming urgent vault backup requirements within 24 hours, and demanded master passwords. This exploit window was chosen because of reduced security staffing and delayed incident response. The pattern is replicable across any service-if you maintain a password vault for your research identities, be aware that phishing is often timed to hit when you are least likely to be paying attention and when incident response is slowest.

Detection and Defense for the Research Community

For those of us tracking these threats, the old playbook of checking URL reputation and static file hashes is obsolete. Analysts at ANY.RUN have highlighted the critical blind spot in most investigation workflows: they are built around static analysis, making them blind to the dynamic behaviors defining modern phishing. Redirect chains, injected scripts, and iframe actions all happen inside the browser-most tools never capture them. For phishing takedown efforts and research verification, you need in-browser data inspection capabilities to see the full DOM modifications and network calls in real-time.

To defend against the current wave, treat every link as hostile. Do not rely on search engines to find market mirrors or vendor pages; SEO poisoning has been used to supply malicious links intentionally to threat researchers looking for live URLs. This also applies to documentation pages for tools you use. Verify the checksum of software from the official repository only-do not click on top-3 search results for an obscure Python library. For credential security, assume your passwords are already burned and your session cookies are being monitored. Keep your research identity separated from your personal and corporate identities. Use unique email addresses and aliases for every market or forum you register on, and enable hardware-based 2FA (YubiKey/security key) wherever possible, as this is currently the most resilient defense against AiTM relay attacks that capture session cookies.

Finally, consider the timing. The holiday-weekend launch pattern highlighted by the LastPass researchers is a classic exploitation of human and technical resource gaps. If you are conducting risky operations-logging into a market, moving funds, or communicating with sensitive contacts-avoid doing so during major U.S. holidays or weekends when your own network monitoring and incident response teams are thin, and when threat actors are actively looking to exploit those exact gaps.

Stay skeptical of unsolicited technical support messages, verify URLs manually, and assume the module you just downloaded could be a ScreenConnect installer in disguise. The landscape is not just about fighting admins for escrow anymore-it is about protecting the credentials that grant access to the network itself, research only, of course.