ZeroTokens Phishing Platform Steers Attacks in Real Time

ZeroTokens is an operator-controlled phishing platform that replicated financial institutions' verification flows and allowed live steering of victim sessions via a persistent WebSocket, enabling operators to capture login credentials, identity documents, card details, SMS/app verification codes and trading passwords. Abnormal AI observed tens of thousands of messages sent to thousands of recipients across hundreds of organizations; the platform used multiple domains and abused SendGrid while passing SPF/DKIM/DMARC checks. Researchers judge the console roles and scope indicate an in-house criminal operation that collects data for fraud executed outside the platform.