# ChenLun 'Outsider' Phishing-as-a-Service Kit with AiTM MFA Bypass Resurges After Law Enforcement Action (Operation Ghost Hook)

> Outsider is a subscription PhaaS kit run by the China-based actor ChenLun, with 267+ templates, SMS-delivered lures and real-time WebSocket/AiTM handling of MFA challenges. Group-IB tracked 100,000+ phishing pages across 54+ countries (Dec 2025-May 2026), and 700+ new pages/domains appeared within a month of Google's lawsuit and the FBI/Google/Lumen takedown (Operation Ghost Hook).

- **Published:** 2026-10-26T14:07:54Z
- **Last reviewed:** 2026-10-26T14:07:54Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4454
- **ID:** TL-2026-4454
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** ChenLun (China)
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Outsider (Chinese: 局外人) is a phishing-as-a-service platform sold by the actor ChenLun through a Telegram ecosystem: a main channel for kit updates, a subscriber-only affiliate group (230+ paying users), a public discussion group (5,000+ members) and a purchase/FAQ bot. Google's court filing reports access from as little as $88 per week ($200 per month) via the Telegram bot @OutsiderCodeBot, and says the operators supplied step-by-step instructions for generating custom phishing code with AI tools. Group-IB counts 267 ready-made templates (Google cites 290+; the hunt note also records a 220+ figure); the sources do not reconcile these counts. Template categories include financial securities/brokerage, points expiration, postal/parcel, government fines, electronic toll collection (ETC), e-commerce (Shopify, WordPress plugins) and Apple ID. CyberScoop's account of the FBI announcement says the operation has been active since July 2023.

Delivery is predominantly SMS phishing (smishing) with urgency pretexts: data-sync warnings, fine notices and parcel fees. Group-IB confirmed smishing against Singapore's Land Transport Authority and similar domestic entities. Google's filing reports roughly 9,000 fake websites and 1.59 million fraudulent URLs (14 Nov 2025-14 Apr 2026), and 55,000 spam texts in a two-week window (18 May-1 Jun 2026). Victims land on pages whose HTML filename prefix marks the attack stage: a_ lures, b_ information collection, c_ payment forms, d_ SMS/2FA verification, e_ email verification, h_ bank login.

The client side is JavaScript. main.js is the harvesting engine: it captures keystrokes (card data, CVV, bank and PayPal credentials, 2FA tokens), profiles the device via IP-geolocation services, spawns a WebSocket through a hidden worker (ws-worker.js), and encrypts payloads with AES-CTR using dynamically generated random 256-bit keys. Group-IB describes an AES-256-CTR envelope with prepended keys on all C2 traffic. common.js holds campaign configuration (projectName, errorJumpAddress for post-phish redirection to a legitimate site, jwr_storage for tracking a victim across tabs). check.js validates card formats and national identifiers (SSN, NINO, SIN, TFN and others across 12+ countries). A file named GetSyncSetting is the real-time C2 command interface. It controls which card/PayPal form is shown, redirects victims, blocks security crawlers and raises live audio alerts to the operator when a victim interacts. Group-IB treats it as a unique identifier of Outsider pages. Anti-analysis uses regex backtracking to freeze developer tools. All input is forwarded to the operator panel in real time, whether or not the victim submits the form.

The AiTM/MFA bypass works by letting the operator serve contextual 2FA challenges (SMS, email, PIN, app) matching the targeted institution's expected methods over the persistent WebSocket, and by redirecting victims to secondary payment pages to harvest multiple cards. Other hunting signatures reported by Group-IB are consistent cfg dictionary keys, /api/open/* REST endpoints, binary WebSocket frames and Cloudflare-fronted C2 on varying ports.

Law enforcement and resilience: Google filed a civil suit in Manhattan federal court on 12 Jun 2026. On 13 Jun 2026 the FBI, Google and Lumen's Black Lotus Labs announced Operation Ghost Hook (part of the FBI's Operation Riptide). Reported results were seizure of domains hosting core admin servers, shutdown of a Shopify storefront, about $100,000 seized from payment wallets (USDT per Google's filing) and thousands of US-registered domains taken down. The FBI used an Outsider Telegram bot to access customer information. Group-IB had identified 10,000+ unique domains before the action, then observed 700+ new pages within a month, and the operator subsequently deleted the Telegram channel. Reported loss figures differ by source: Google says 100,000+ victims and millions of dollars in losses, while CyberScoop's account of the FBI release cites about $1.9 billion in losses and about 3.9 million stolen cards. Neither is independently verified here. No domains, IPs or file hashes were published in the cited sources, so network IOCs are not available, and BeaconBeagle correlation was not possible.

## MITRE ATT&CK

- T1583.001 Domains
- T1660 Phishing
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1027 Obfuscated Files or Information
- T1027.013 Encrypted/Encoded File
- T1622 Debugger Evasion
- T1111 Multi-Factor Authentication Interception
- T1056.003 Web Portal Capture
- T1119 Automated Collection
- T1071.001 Web Protocols
- T1095 Non-Application Layer Protocol
- T1573.001 Symmetric Cryptography
- T1657 Financial Theft

## Sources

- [The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action (Group-IB)](https://www.group-ib.com/blog/chenlun-outsider-phaas-kit/)
- [Google sues Chinese smishing network (The Hacker News)](https://thehackernews.com/2026/06/google-sues-chinese-smishing-network.html)
- [Outsider cybercrime network takedown: China, FBI, Google, Lumen (CyberScoop)](https://cyberscoop.com/outsider-cybercrime-network-takedown-china-fbi-google-lumen/)
- [Outsider Phishing Kit Survives Takedown With 700 New Pages (Infosecurity Magazine)](https://infosecurity-magazine.com/news/outsider-phishing-kit-survives)
- [Sophisticated Phishing Operation Continues to Thrive Following FBI Takedown (KnowBe4)](https://blog.knowbe4.com/sophisticated-phishing-operation-continues-to-thrive-following-fbi-takedown)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4454