Threat reportPhishingTL-2026-4454
ChenLun 'Outsider' Phishing-as-a-Service Kit with AiTM MFA Bypass Resurges After Law Enforcement Action (Operation Ghost Hook)
ChenLun 'Outsider' Phishing-as-a-Service Kit with AiTM MFA (TL-2026-4454), also tracked as Outsider phishing kit, is a high-severity phishing campaign, first published 2026-10-26. It is attributed to ChenLun (China) with medium confidence, affects Multiple (brand impersonation) Financial services, brokerage, telecom, maps to 14 MITRE ATT&CK techniques (T1027, T1027.013, T1056.003), and is covered by 9 detection rules and 13 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 14MITRE ATT&CK
- Actors
- 1ChenLun
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-4454
- Threat ID
- TL-2026-4454
- Also known as
- Outsider phishing kit, Operation Ghost Hook
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution
- ChenLun
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- FINANCIAL
- Target sectors
- finance, brokerage, telecoms, postal-shipping, government administration, transportation-tolls, ecommerce, consumers
- Target regions
- Global, singapore, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 13
Malware and tooling in ChenLun 'Outsider' Phishing-as-a-Service Kit with AiTM MFA
Malware and tooling: Outsider, Outsider phishing kit, telegram
How ChenLun 'Outsider' Phishing-as-a-Service Kit with AiTM MFA works
Outsider is a subscription PhaaS kit run by the China-based actor ChenLun, with 267+ templates, SMS-delivered lures and real-time WebSocket/AiTM handling of MFA challenges. Group-IB tracked 100,000+ phishing pages across 54+ countries (Dec 2025-May 2026), and 700+ new pages/domains appeared within a month of Google's lawsuit and the FBI/Google/Lumen takedown (Operation Ghost Hook).
Outsider (Chinese: 局外人) is a phishing-as-a-service platform sold by the actor ChenLun through a Telegram ecosystem: a main channel for kit updates, a subscriber-only affiliate group (230+ paying users), a public discussion group (5,000+ members) and a purchase/FAQ bot. Google's court filing reports access from as little as $88 per week ($200 per month) via the Telegram bot @OutsiderCodeBot, and says the operators supplied step-by-step instructions for generating custom phishing code with AI tools. Group-IB counts 267 ready-made templates (Google cites 290+; the hunt note also records a 220+ figure); the sources do not reconcile these counts. Template categories include financial securities/brokerage, points expiration, postal/parcel, government fines, electronic toll collection (ETC), e-commerce (Shopify, WordPress plugins) and Apple ID. CyberScoop's account of the FBI announcement says the operation has been active since July 2023.
Delivery is predominantly SMS phishing (smishing) with urgency pretexts: data-sync warnings, fine notices and parcel fees. Group-IB confirmed smishing against Singapore's Land Transport Authority and similar domestic entities. Google's filing reports roughly 9,000 fake websites and 1.59 million fraudulent URLs (14 Nov 2025-14 Apr 2026), and 55,000 spam texts in a two-week window (18 May-1 Jun 2026). Victims land on pages whose HTML filename prefix marks the attack stage: a_ lures, b_ information collection, c_ payment forms, d_ SMS/2FA verification, e_ email verification, h_ bank login.
The client side is JavaScript. main.js is the harvesting engine: it captures keystrokes (card data, CVV, bank and PayPal credentials, 2FA tokens), profiles the device via IP-geolocation services, spawns a WebSocket through a hidden worker (ws-worker.js), and encrypts payloads with AES-CTR using dynamically generated random 256-bit keys. Group-IB describes an AES-256-CTR envelope with prepended keys on all C2 traffic. common.js holds campaign configuration (projectName, errorJumpAddress for post-phish redirection to a legitimate site, jwr_storage for tracking a victim across tabs). check.js validates card formats and national identifiers (SSN, NINO, SIN, TFN and others across 12+ countries). A file named GetSyncSetting is the real-time C2 command interface. It controls which card/PayPal form is shown, redirects victims, blocks security crawlers and raises live audio alerts to the operator when a victim interacts. Group-IB treats it as a unique identifier of Outsider pages. Anti-analysis uses regex backtracking to freeze developer tools. All input is forwarded to the operator panel in real time, whether or not the victim submits the form.
The AiTM/MFA bypass works by letting the operator serve contextual 2FA challenges (SMS, email, PIN, app) matching the targeted institution's expected methods over the persistent WebSocket, and by redirecting victims to secondary payment pages to harvest multiple cards. Other hunting signatures reported by Group-IB are consistent cfg dictionary keys, /api/open/* REST endpoints, binary WebSocket frames and Cloudflare-fronted C2 on varying ports.
Law enforcement and resilience: Google filed a civil suit in Manhattan federal court on 12 Jun 2026. On 13 Jun 2026 the FBI, Google and Lumen's Black Lotus Labs announced Operation Ghost Hook (part of the FBI's Operation Riptide). Reported results were seizure of domains hosting core admin servers, shutdown of a Shopify storefront, about $100,000 seized from payment wallets (USDT per Google's filing) and thousands of US-registered domains taken down. The FBI used an Outsider Telegram bot to access customer information. Group-IB had identified 10,000+ unique domains before the action, then observed 700+ new pages within a month, and the operator subsequently deleted the Telegram channel. Reported loss figures differ by source: Google says 100,000+ victims and millions of dollars in losses, while CyberScoop's account of the FBI release cites about $1.9 billion in losses and about 3.9 million stolen cards. Neither is independently verified here. No domains, IPs or file hashes were published in the cited sources, so network IOCs are not available, and BeaconBeagle correlation was not possible.
MITRE ATT&CK techniques used in TL-2026-4454
Defense Evasion
T1027 Obfuscated Files or Information; T1027.013 Encrypted/Encoded File; T1622 Debugger Evasion
Collection
T1056.003 Web Portal Capture; T1119 Automated Collection
Command and Control
T1071.001 Web Protocols; T1095 Non-Application Layer Protocol; T1573.001 Symmetric Cryptography
Credential Access
T1111 Multi-Factor Authentication Interception
Execution
Initial Access
Resource Development
Impact
initial-access
Affected products and versions in ChenLun 'Outsider' Phishing-as-a-Service Kit with AiTM MFA
- Multiple (brand impersonation) — Financial services, brokerage, telecom, postal/shipping, government and toll-collection brands, e-commerce, Apple ID
Remediation for ChenLun 'Outsider' Phishing-as-a-Service Kit with AiTM MFA
Immediate actions
- Block or sinkhole phishing domains matching Outsider page signatures (GetSyncSetting, /api/open/* endpoints, a_/b_/c_/d_/e_/h_ filename prefixes)
- Enable SMS and brand-abuse monitoring for impersonation of your brand, toll, postal and government services
- Submit identified phishing pages for takedown using the HTML filename-prefix signatures
Workarounds
- Treat any SMS link that prompts for card data, CVV or 2FA codes as malicious
- Use issuer-side transaction alerts and card-not-present controls to limit fraud after harvest
Longer-term hardening
- Move high-value users to phishing-resistant MFA (FIDO2/passkeys); OTP, SMS and push codes can be relayed through AiTM
- Integrate threat intelligence for early phishing-kit detection and monitor for new domains hosting the kit
- Train users to verify SMS alerts through official apps or sites and never enter payment data via SMS links
Timeline of ChenLun 'Outsider' Phishing-as-a-Service Kit with AiTM MFA
- Per CyberScoop's account of the FBI announcement, the Outsider operation has been active since July 2023 (month precision; day not stated).
- Start of the window (to 2026-04-14) in which Google's filing counts about 9,000 fake websites and 1.59 million fraudulent URLs tied to Outsider.
- Start of the Group-IB-tracked campaign period (December 2025 to May 2026) with 100,000+ phishing pages across 54+ countries (month precision).
- Start of a two-week window (to 2026-06-01) in which Google's filing counts 55,000 spam texts and 2.5 million messages sent to Android users.
- Google files a civil lawsuit in Manhattan federal court against the operators of the Outsider PhaaS platform.
- FBI, Google and Lumen's Black Lotus Labs announce Operation Ghost Hook: core admin server domains seized, Shopify storefront shut down, about $100,000 seized from payment wallets and thousands of domains taken down.
- Group-IB observes 700+ new phishing pages/domains within one month of the lawsuit, showing affiliates kept using the kit (approximate date: one month after 2026-06-12/13). The operator later deleted the Telegram channel.
- Group-IB publishes its technical analysis of the Outsider kit (GetSyncSetting, AES-256-CTR C2, WebSocket AiTM, anti-debugging).
Sources cited for ChenLun 'Outsider' Phishing-as-a-Service Kit with AiTM MFA
- The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action (Group-IB)
- Google sues Chinese smishing network (The Hacker News)
- Outsider cybercrime network takedown: China, FBI, Google, Lumen (CyberScoop)
- Outsider Phishing Kit Survives Takedown With 700 New Pages (Infosecurity Magazine)
- Sophisticated Phishing Operation Continues to Thrive Following FBI Takedown (KnowBe4)
Detection coverage for TL-2026-4454
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4454 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.