Deep water: exploring phishing kits

This Group-IB report analyzes a decade-long phishing kit collection and describes how kits target over 260 brands (notably Microsoft, PayPal, Google, Yahoo), the common exfiltration channels (email, multiple addresses, GET/POST to remote servers, Telegram API, Google Forms), storage options (local text files, MySQL), and additional malicious capabilities—such as embedding malware upload routines, web shells, hidden developer backdoors, and obfuscation techniques—that enable widespread credential theft and post-compromise control.