Topic starter
12/06/2026 9:18 pm
TL;DR: Active phishing panels linked to ShinyHunters-style and BlackFile-associated campaigns combine vishing, AiTM phishing, and browser-gated credential capture across hundreds of domains, with public breaches already tied to stolen sessions and downstream SaaS access, according to Push Security. The core issue is that browser-mediated identity theft now bypasses email-centric controls and defeats assumptions that static infrastructure scanning can keep pace.
Editorial analysis by NHI Mgmt Group, based on content published by Push Security: “We infiltrated a criminal phishing panel: hereâs what we found”.
By the numbers:
- Push Security identified over 400 domains linked to the attacks, giving an indication of the scale.
Key questions
Q: What breaks when phishing panels only show malicious content to live targets?
A: Infrastructure scanning breaks first, because the malicious page is hidden behind a browser gate until an operator approves the victim.
Q: Why do AiTM phishing kits still succeed against MFA?
A: AiTM kits succeed because they capture the authenticated session, not just the password.
A: Teams should treat the browser as an identity control point, not just a user interface.
Practitioner guidance
- Strengthen browser-layer detection Instrument the rendered page and client-side behaviour so that gated phishing flows, redirects and credential capture logic can be detected where the user actually sees them.
- Harden helpdesk-assisted recovery paths Review support workflows that can be used to establish trust, reset credentials or trigger MFA enrolment, because the attacks described rely on human confirmation before browser compromise.
- Reduce dependence on OTP and push approvals Limit where one-time codes and approval prompts are accepted, especially for high-risk sign-ins and sensitive SaaS access that can be hijacked in real time.
Bottom line: Browser-gated phishing changes the detection problem by hiding malicious content until a live target is present.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/06/2026 11:17 pm
Browser-gated phishing creates an identity theft model that static controls cannot see. The malicious page is hidden until a real target arrives, which means infrastructure scanning, reputation feeds and bulk takedown logic arrive too late to matter. This is not just a delivery refinement, it is a shift in how attack evidence exists. Practitioners should treat browser rendering as the detection boundary, not the domain name.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: How should IAM teams respond when SaaS abuse happens through the browser?
A: They should treat the browser as part of the identity control plane and align app access governance, session monitoring, and response workflows around it. That means reviewing permissions, extension risk, and session behaviour together instead of separating browser threats from identity governance.
👉 Read our full editorial: AI phishing panels are industrialising browser-based identity theft