OutsiderMalware
Last reported 1 month ago, by Group-IB6 reports
ATT&CK techniques
6 of 25 · each with the sentence it comes from- T1027Obfuscated Files or Information
“T1027 Obfuscated Files or Information”
- T1027.013Encrypted/Encoded File
“T1027.013 Encrypted/Encoded File”
- T1041Exfiltration Over C2 Channel
“T1041 Exfiltration Over C2 Channel”
- T1056Input Capture
“T1056.003 Input Capture: Web Portal Capture”
- T1056.003Web Portal Capture
“T1056.003 Input Capture: Web Portal Capture”
- T1071.001Web Protocols
“T1071.001 Web Protocols”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit“A deep technical analysis of the Smishing Triad’s JWR phishing kit and Outsider operator cluster, revealing its real-time victim control, encrypted WebSocket communications, multi-stage credential theft, AES-256-CTR implementation, infrastructure, and actionable indicators for de…”
-
GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI“For example, in June 2026, Google disrupted "Outsider Enterprise", a China-based cyber crime service providing phishing kits that enable mass impersonation of Google and other trusted brands.”
-
Risky Bulletin: Russia tells data centers to deploy drone defenses“Outsider PhaaS returns: The Outsider phishing service has returned online after a Google-orchestrated takedown and lawsuit in June.”
-
Outsider Phishing Kit Survives Takedown With 700 New Pages“Outsider Phishing Kit Survives Takedown With 700 New Pages”
-
The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action“The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action”
-
Five Years, 88,000 Backdoors, and a Pair of Handcuffs: Inside the Global Manhunt That Ended in an Arrest“Outsider, a Chinese phishing-as-a-service platform running since 2023, tied to over 8,000 phishing domains, an estimated 3.87 million stolen credit cards, and roughly $1.9 billion in global losses.”
Indicators in its reports
named in the reports above- obfuscator[.]ioin 2 reports
- javascript-obfuscator[.]ioin 2 reports
- idscan[.]netin 1 report
- httpbin[.]orgin 1 report
- window[.]topin 1 report
- trsb[.]topin 1 report
- date[.]nowin 1 report
- workercrypto[.]postin 1 report
- crypto[.]newsin 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.