{
  "Event": {
    "analysis": "1",
    "date": "2026-06-25",
    "extends_uuid": "",
    "info": "[Threat Intel] Blacksite: New AiTM Phishing Kit Evades URL Scanners via Cloaked.gg",
    "protected": false,
    "publish_timestamp": "1783858371",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1783858371",
    "uuid": "979974e7-f566-4534-bf0d-ce22e25c1908",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#10003f",
        "local": false,
        "name": "rectifyq:sub-category=\"tool-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#e96364",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Adversary-in-the-Middle - T1557\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782990011",
        "to_ids": false,
        "type": "link",
        "uuid": "387a5440-16b3-46b5-8d86-4707c2b5a9b3",
        "value": "https://abnormal.ai/es/blog/blacksite-aitm-phishing-kit-cloaked-gg",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782990011",
        "to_ids": false,
        "type": "text",
        "uuid": "ff0cea7f-7a13-44ec-afa9-95a9dd9fe274",
        "value": "Blacksite is a newly identified adversary-in-the-middle phishing-as-a-service offering sold alongside Cloaked.gg, a cloaking platform that conceals phishing infrastructure from automated security analysis. The kit operates as a reverse-proxy that intercepts authentication tokens, session cookies, and 2FA codes in real time, enabling full account takeover even against MFA-protected accounts. Cloaked.gg blocks traffic from AWS, Google Cloud, and Azure networks while serving AI-generated decoy pages to suspected scanners, making malicious URLs appear benign during automated analysis. Priced between $600-$1,000 monthly, the service commercializes sophisticated AiTM techniques, lowering technical barriers for attackers. The pairing of credential theft capabilities with anti-detection infrastructure creates a split-view environment where security tools see harmless content while intended victims are routed to live phishing pages targeting consumer, financial, and enterprise identity systems."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782990011",
        "to_ids": false,
        "type": "text",
        "uuid": "cf66a611-dc93-4428-95ac-5c3a6120303d",
        "value": "Name: Blacksite: New AiTM Phishing Kit Evades URL Scanners via Cloaked.gg\nAuthor: AlienVault\nAdversary: kirapayload\nTags: [\"credential-theft\", \"url-evasion\", \"aitm\", \"mfa-bypass\", \"blacksite\", \"session-hijacking\", \"cloaking\", \"reverse-proxy\", \"tycoon 2fa\", \"phishing-as-a-service\"]\nTgtd countries: []\nMlwr families: [\"Blacksite\", \"Tycoon 2FA\"]\nAttack_ids: []\nIndustries: [\"Finance\", \"Technology\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782990011",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "1e3f962a-f549-48f4-a433-877165c762e1",
        "value": "kirapayload"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847676",
        "to_ids": true,
        "type": "domain",
        "uuid": "da743d7e-aab9-4868-bd14-8d37a81504db",
        "value": "allegro-pl.site",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847698",
        "to_ids": true,
        "type": "domain",
        "uuid": "aa240a2f-3e81-4b6a-b43d-96dfe601a1a3",
        "value": "allegro-pl.top",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847719",
        "to_ids": true,
        "type": "domain",
        "uuid": "2cf8e745-b293-4327-a884-7fe5efa8803b",
        "value": "charliesdemons.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847740",
        "to_ids": true,
        "type": "domain",
        "uuid": "2f76a9ca-e186-4e4c-9635-5bb8ab276b2d",
        "value": "cloaked-demo.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847761",
        "to_ids": true,
        "type": "domain",
        "uuid": "aad596da-d2b5-4b86-a586-f66015198b6f",
        "value": "cloaked.gg",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847782",
        "to_ids": true,
        "type": "hostname",
        "uuid": "14ab28e8-a49d-4225-b7b7-e15af528a265",
        "value": "api.cloaked.gg",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847803",
        "to_ids": true,
        "type": "hostname",
        "uuid": "b6035ada-7ab8-4411-a913-30f5dc225577",
        "value": "capture.cloaked.gg",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847824",
        "to_ids": true,
        "type": "hostname",
        "uuid": "4591d042-edfb-402a-aa65-08c4da6a0a88",
        "value": "cdn.cloaked.gg",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847846",
        "to_ids": true,
        "type": "hostname",
        "uuid": "36442532-fa3e-443f-99fb-9046ef0a08fc",
        "value": "app.cloaked.gg",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847867",
        "to_ids": true,
        "type": "url",
        "uuid": "2945359b-a19c-4e8b-8e94-0a5dd0c3c65e",
        "value": "telegra.ph/Cloakedgg-BlackSite-06-07",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}