Notifications
Clear all
Topic starter
12/06/2026 9:18 pm
TL;DR: Active phishing panels linked to ShinyHunters-style and BlackFile-associated campaigns combine vishing, AiTM phishing, and browser-gated credential capture across hundreds of domains, with public breaches already tied to stolen sessions and downstream SaaS access, according to Push Security. The core issue is that browser-mediated identity theft now bypasses email-centric controls and defeats assumptions that static infrastructure scanning can keep pace.
NHIMG editorial — based on content published by Push Security: an inside look at a phishing panel used in criminal campaigns
By the numbers:
- In total, we’ve identified over 400 domains linked to the attacks, giving an indication of the scale.
Questions worth separating out
A: Security teams should combine browser telemetry, behavioural page analysis, and identity controls that reduce the value of a live session.
Q: Why do browser-based AiTM attacks create more risk than password phishing alone?
A: AiTM attacks capture the full authenticated flow, including MFA responses and the resulting session.
Q: What do teams get wrong about detecting modern phishing infrastructure?
A: Many teams assume that malicious infrastructure can be found through static scanning or blocklists before it is used.
Practitioner guidance
- Prioritise browser-side attack detection Inspect rendered pages, redirects, form submission paths, and operator-gated content in real time.
- Harden against session relay, not only password theft Use phishing-resistant authentication where possible and add controls that reduce the value of a captured session, including step-up checks for sensitive SaaS actions and tighter token lifetimes.
- Map which applications trust the identity provider too broadly Inventory the SaaS platforms that can be reached after primary login and identify where a single stolen session can cascade into document access, messaging, or data export.
What's in the full article
Push Security's full analysis covers the operational detail this post intentionally leaves for the source:
- Technical indicators for Doko's Panel and its variants, including client-side request patterns and backend endpoint names
- Examples of the phishing infrastructure clusters, domain patterns, and hosting choices observed across campaigns
- Operator workflow details showing how victim submissions, redirects, and MFA capture were handled in real time
- The longer list of indicators of compromise and the browser-based detection considerations tied to them
👉 Read Push Security's analysis of active phishing panels used in browser-based identity theft →
Browser-gated phishing panels: what they mean for IAM teams?
Explore further
12/06/2026 11:17 pm
Browser-mediated identity theft has become a control plane problem, not just a phishing problem. The panel described here does not rely on bulk email delivery or obvious malware. It waits for a live browser session, then steers the victim through credential and MFA capture in real time. That shifts the security question from message filtering to session integrity, identity assurance, and browser-layer observability. The practitioner conclusion is straightforward: if the browser can be used to broker the compromise, it must also be part of the detection model.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months.
A question worth separating out:
Q: Who is accountable when a stolen session is used to pivot into SaaS platforms?
A: Accountability usually sits across identity operations, application owners, and security monitoring teams because the compromise crosses multiple control boundaries. Identity providers may authenticate the session, but connected SaaS platforms determine how far the attacker can go. Organisations need clear ownership for session risk, app trust, and post-login containment.
👉 Read our full editorial: AI phishing panels are industrialising browser-based identity theft
