{
  "name": "Blacksite: New AiTM Phishing Kit Evades URL Scanners via Cloaked.gg",
  "slug": "blacksite-new-aitm-phishing-kit-evades-url-scanners-via-cloakedgg",
  "description": "Blacksite is a newly identified adversary-in-the-middle phishing-as-a-service offering sold alongside Cloaked.gg, a cloaking platform that conceals phishing infrastructure from automated security analysis. The kit operates as a reverse-proxy that intercepts authentication tokens, session cookies, and 2FA codes in real time, enabling full account takeover even against MFA-protected accounts. Cloaked.gg blocks traffic from AWS, Google Cloud, and Azure networks while serving AI-generated decoy pages to suspected scanners, making malicious URLs appear benign during automated analysis. Priced between $600-$1,000 monthly, the service commercializes sophisticated AiTM techniques, lowering technical barriers for attackers. The pairing of credential theft capabilities with anti-detection infrastructure creates a split-view environment where security tools see harmless content while intended victims are routed to live phishing pages targeting consumer, financial, and enterprise identity systems.",
  "published": "2026-07-02T09:50:33.226000+00:00",
  "created_at": "2026-07-02T10:13:48.464000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-07-02T10:13:48.464000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "aitm",
    "blacksite",
    "cloaking",
    "credential-theft",
    "mfa-bypass",
    "phishing-as-a-service",
    "reverse-proxy",
    "session-hijacking",
    "tycoon 2fa",
    "url-evasion"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "ec396aca-a084-4559-84ae-0d8d2155e3bc",
        "name": "allegro-pl.site"
      },
      {
        "id": "e30119d5-1c7e-4c54-8619-00a2ab12bb68",
        "name": "cloaked-demo.com"
      },
      {
        "id": "c77b6b14-f852-4804-8bcb-9b7f2426ad8c",
        "name": "charliesdemons.com"
      },
      {
        "id": "6abccec2-ffa5-4fcf-8503-f83cf137b61d",
        "name": "capture.cloaked.gg"
      },
      {
        "id": "2616357d-875a-4d69-bdb1-87cfa1d8570b",
        "name": "cdn.cloaked.gg"
      },
      {
        "id": "de86d80e-52ec-4107-91a4-2787960d53bd",
        "name": "allegro-pl.top"
      },
      {
        "id": "7988e261-3435-4b84-8465-e101224dec28",
        "name": "cloaked.gg"
      },
      {
        "id": "3eb32c7d-ac06-445f-80a3-014aa65f8b3b",
        "name": "api.cloaked.gg"
      }
    ],
    "intrusion_sets": [
      {
        "id": "28f871a8-bea9-4b84-a808-057954ad9161",
        "name": "kirapayload",
        "slug": "kirapayload"
      }
    ],
    "malware": [
      {
        "id": "48baeea5-d9f5-46ee-9b41-c0bb1ee14953",
        "name": "Tycoon 2FA",
        "slug": "tycoon-2fa"
      },
      {
        "id": "3cdb5774-eaff-48f6-9efe-5e3324243edc",
        "name": "Blacksite",
        "slug": "blacksite"
      }
    ],
    "observables": [
      {
        "id": "8857cdd0-2589-46e5-bac1-90fde6c5f0b9",
        "name": "cloaked-demo.com"
      },
      {
        "id": "513deae2-c867-4f35-8760-1ba58dfa39f6",
        "name": "charliesdemons.com"
      },
      {
        "id": "fc735cef-8357-45a7-b955-cd8cbba53f26",
        "name": "allegro-pl.top"
      },
      {
        "id": "aff4f110-8c48-4921-9eb2-d3afc19fa80e",
        "name": "allegro-pl.site"
      },
      {
        "id": "5c677ac0-4a89-4cfd-adae-533a618fb502",
        "name": "cloaked.gg"
      },
      {
        "id": "41d51247-72aa-4c42-8960-c8a52af40379",
        "name": "api.cloaked.gg"
      },
      {
        "id": "62d70667-b5c6-46a7-b932-72ee990f59d5",
        "name": "capture.cloaked.gg"
      },
      {
        "id": "3b42519a-d786-4b1a-9e57-fb7c1eae4cab",
        "name": "cdn.cloaked.gg"
      }
    ]
  },
  "external_refs": [
    {
      "id": "2aa1ba52-9933-4502-b97e-3d5fe530b92c",
      "standard_id": "external-reference--77a09390-d7f4-5657-ace2-d370a1f89a77",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://abnormal.ai/es/blog/blacksite-aitm-phishing-kit-cloaked-gg",
      "hash": null,
      "external_id": null,
      "created": "2026-07-02T10:13:46.707Z",
      "modified": "2026-07-02T10:13:46.707Z",
      "createdById": null
    },
    {
      "id": "a67376fb-40a8-42a0-a3d2-0c90632ff19c",
      "standard_id": "external-reference--f98e8f21-46c0-5ef7-a511-5ac94e2bc4ed",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a463469f06125cbab68ef8c",
      "hash": null,
      "external_id": "6a463469f06125cbab68ef8c",
      "created": "2026-07-02T10:13:46.681Z",
      "modified": "2026-07-02T10:13:46.681Z",
      "createdById": null
    }
  ]
}