# \[Phishing Kit\] Jizhu code reuse

**URL:** <https://community.bolster.ai/t/phishing-kit-jizhu-code-reuse/113>\
**Category:** Phishing Kits\
**Tags:** phishingkit\
**Created:** [March 12, 2024, 2:54am UTC](https://community.bolster.ai/t/phishing-kit-jizhu-code-reuse/113 "2024-03-12T02:54:53Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![S1nglet0n](https://yyz2.discourse-cdn.com/flex028/user_avatar/community.bolster.ai/s1nglet0n/32/237_2.png) [@S1nglet0n](https://community.bolster.ai/u/S1nglet0n)\
**Post date:** [March 12, 2024, 2:54am UTC](https://community.bolster.ai/t/phishing-kit-jizhu-code-reuse/113/1 "2024-03-12T02:54:53Z")

</div>

I have been running across landing pages harvesting credentials initiated by Telegram social engineering. It appears most of the landing pages are using a similar kit landing page which usually has the following paths for different aspects of the login page…

/index/user/login.html (login page with code reuse like login\_btn which calls /index/user/do\_login.html)

1 Sample seen to be reused is this  
/_点击登录_/ (Eng: Click to Login)  
$(“.login\_btn”).on(‘click’,function(){

```
        if(check()){
            var loading = null;
            var tel = $("input[name=tel]").val();
            var pwd = $("input[name=pwd]").val();
            var jizhu = $("input[name=jizhu]").val();
            $.ajax({
                url:"/index/user/do_login.html",
                data:{tel:tel,pwd:pwd,jizhu:jizhu},

```

Other paths referenced by the kit include:  
/index/user/register (target registration info page like phone, email, name, etc.)  
/index/user/register\_desc.html (privacy policy page)  
/index/index/home.html (setTimeout Function)

Any knowledge as to what kit might be behind this?

VT Search: index/user/login.html should present quite a few samples that match the above - occurring over the past 3+ months.

---

<div class="post-metadata">

**Author:** ![zero](https://yyz2.discourse-cdn.com/flex028/user_avatar/community.bolster.ai/zero/32/78_2.png) [@zero](https://community.bolster.ai/u/zero)\
**Post date:** [March 13, 2024, 4:48pm UTC](https://community.bolster.ai/t/phishing-kit-jizhu-code-reuse/113/2 "2024-03-13T16:48:53Z")

</div>

Thank you for sharing @S1nglet0n. Currently, we do not have a phishing kit with a similar code block and referenced paths. We setup an alert for this and will let you know if something pops up.

---

<div class="post-metadata">

**Author:** ![CyberKnight15](https://yyz2.discourse-cdn.com/flex028/user_avatar/community.bolster.ai/cyberknight15/32/217_2.png) [@CyberKnight15](https://community.bolster.ai/u/CyberKnight15)\
**Post date:** [March 13, 2024, 5:57pm UTC](https://community.bolster.ai/t/phishing-kit-jizhu-code-reuse/113/3 "2024-03-13T17:57:11Z")

</div>

great find and thanks for sharing @S1nglet0n, ill keep an eye out for this one too

---

<div class="post-metadata">

**Author:** ![S1nglet0n](https://yyz2.discourse-cdn.com/flex028/user_avatar/community.bolster.ai/s1nglet0n/32/237_2.png) [@S1nglet0n](https://community.bolster.ai/u/S1nglet0n)\
**Post date:** [March 13, 2024, 6:14pm UTC](https://community.bolster.ai/t/phishing-kit-jizhu-code-reuse/113/4 "2024-03-13T18:14:55Z")

</div>

Thank you very much. Looking forward to what can be uncovered. Seems like a common landing page used by many actors using different objectives on different brands/themes.

I don’t have access to it, but GREATNESS PhaaS seemed like an obvious choice from OSINT

Also in the mix were CAFFEINE, LABHOST, FRAPPO

From 2022 data, I didn’t see many leads:  
[https://www.resecurity.com/blog/article/welcome-frappo-the-new-phishing-as-a-service-used-by-cybercriminals-to-attack-customers-of-major-financial-institutions-and-online-retailers](https://www.resecurity.com/blog/article/welcome-frappo-the-new-phishing-as-a-service-used-by-cybercriminals-to-attack-customers-of-major-financial-institutions-and-online-retailers)

---

<div class="post-metadata">

**Author:** ![S1nglet0n](https://yyz2.discourse-cdn.com/flex028/user_avatar/community.bolster.ai/s1nglet0n/32/237_2.png) [@S1nglet0n](https://community.bolster.ai/u/S1nglet0n)\
**Post date:** [March 13, 2024, 9:41pm UTC](https://community.bolster.ai/t/phishing-kit-jizhu-code-reuse/113/5 "2024-03-13T21:41:53Z")

</div>

Something worth noting too:  
phishkit vs. phaas

> **[Catching the big fish: Analyzing a large-scale phishing-as-a-service operation...](https://www.microsoft.com/en-us/security/blog/2021/09/21/catching-the-big-fish-analyzing-a-large-scale-phishing-as-a-service-operation/)**
>
> With over 100 available phishing templates that mimic known brands and services, the BulletProofLink operation is responsible for many of the phishing campaigns that impact enterprises today. We are sharing these findings so the broader community can...

---

<div class="post-metadata">

**Author:** ![S1nglet0n](https://yyz2.discourse-cdn.com/flex028/user_avatar/community.bolster.ai/s1nglet0n/32/237_2.png) [@S1nglet0n](https://community.bolster.ai/u/S1nglet0n)\
**Post date:** [March 13, 2024, 10:33pm UTC](https://community.bolster.ai/t/phishing-kit-jizhu-code-reuse/113/6 "2024-03-13T22:33:38Z")

</div>

Here is a good/better VT hash search showing some of the jizhu samples going as far back as May 2023 with the similar code seen in recent samples…

virustotal search:  
vhash:“htm:3fe983f4f4faed24155219f2ddfa0418”

OR

entity:url path:/index/user/login.html

```auto
// Add your logic to submit to your backend server here.
form_submit(token)
function form_submit(reCAPTCHA) {
var loading = null
var tel = $("input[name=tel]").val()
var pwd = $("input[name=pwd]").val()
var jizhu = $("input[name=jizhu]").val()
var tc08d2f7709807240b0578c61f8013850 = "60425c8d045e9"
$.ajax({
url: "/index/user/do_login.html",
data: {
tel: tel,
pwd: pwd,
jizhu: jizhu,
'_csrf_': tc08d2f7709807240b0578c61f8013850,
'reCAPTCHA': reCAPTCHA
type: 'POST',
beforeSend: function(request) {
request.setRequestHeader('User-Token-Csrf', tc08d2f7709807240b0578c61f8013850)
loading = $(document).dialog({
type: 'notice',
infoIcon: '/static_new/img/loading.gif',
infoText: 'loading...',
autoClose: 0
success: function(data) {
loading.close()
if (data.code == 0) {
infoText: data.info
setTimeout(function() {
location.href = "/index/index/home.html"
if (data.info) {
infoText: "The network is unstable, please try again in a place with a better signal
autoClose: 2000
error: function(data) {
--tj--></body></html>

```

---

<div class="post-metadata">

**Author:** ![zero](https://yyz2.discourse-cdn.com/flex028/user_avatar/community.bolster.ai/zero/32/78_2.png) [@zero](https://community.bolster.ai/u/zero)\
**Post date:** [March 14, 2024, 5:40pm UTC](https://community.bolster.ai/t/phishing-kit-jizhu-code-reuse/113/7 "2024-03-14T17:40:10Z")

</div>

@S1nglet0n can you share a couple of landing pages on here? We can try to pivot off of these.

---

<div class="post-metadata">

**Author:** ![S1nglet0n](https://yyz2.discourse-cdn.com/flex028/user_avatar/community.bolster.ai/s1nglet0n/32/237_2.png) [@S1nglet0n](https://community.bolster.ai/u/S1nglet0n)\
**Post date:** [March 14, 2024, 6:36pm UTC](https://community.bolster.ai/t/phishing-kit-jizhu-code-reuse/113/8 "2024-03-14T18:36:13Z")

</div>

Sure - if you go to VirusTotal and type: entity:url path:/index/user/login.html

First sample from today:

> **[VirusTotal](https://www.virustotal.com/gui/url/2a244cbf35df6a802affe79bb6d4907b892d360bf5e8649420338a83ea7109d6/content)**
>
> VirusTotal

And just scroll through the results…there are 100’s & 1000’s (depending on your access level to VT historical data)