urlscan.io Blog

This report documents two closely related phishing clusters identified by the urlscan Threat Research Team, both targeting social media users, primarily YouTube content creators, with the goal of gaining access to Google accounts. Both clusters employ a multi-stage phishing flow, beginning with a YouTube-themed lure and culminating in a highly engineered Browser-in-the-Browser (BitB) technique designed to convincingly impersonate the Google sign-in experience. Notable findings include a victim-selection mechanism based on subscriber count and a sophisticated credential-harvesting flow capable of bypassing multiple forms of multi-factor authentication (MFA).

Background

The urlscan Threat Research Team received a notification regarding a set of YouTube-themed phishing sites that had not yet been publicly identified. Investigation of these initial examples revealed that they formed part of a larger phishing operation. Further pivoting identified a second, closely related cluster sharing the same general phishing methodology and likely originating from a common codebase.

Both clusters share a common phishing flow, which is described in detail in the Phishing Flow section below. The following sections first document each cluster’s infrastructure fingerprints, detection searches, and distinguishing characteristics.

The GSVerify Cluster

The original examples submitted to the urlscan Threat Research Team share a unique variable which provides a simple and effective starting point for clustering related activity.

This search returned multiple results, with the oldest observed instance dating back approximately one month at the time of writing. Given the infrastructure and codebase maturity observed, it was considered likely that the cluster had been active for considerably longer.

A secondary pivot was constructed around a cookie name, which is set during the initial page load as part of the kit’s worker assignment mechanism. This surfaced related sites that shared the same JavaScript codebase.

API Endpoints

This cluster relies on a set of API endpoints for various discrete operations. The following endpoints have been observed across the different variants of the kit:

• /api/antibot/captcha-init
• /api/antibot/captcha-verify
• /api/antibot/init
• /api/antibot/verify-hard
• /api/slot/autoclean
• /api/slot/claim
• /api/slot/ping
• /api/slot/release
• /api/visitor-init
• /api/success-config
• /api/client-log
• /api/current-page
• /api/pushmfa-context
• /api/asset

Worker Configuration

Early in each page load, a request is made to /api/workers, which returns a JSON structure mapping named “worker” identifiers to URL path configurations. This endpoint is also responsible for setting the worker_id cookie observed in the pivot search above.

{
    "success": true,
    "workers": [
        { "worker": "flora", "path": ["raggy", "heugi"] },
        { "worker": "mamura", "path": ["mamura"] },
        { "worker": "swis", "path": ["swis"] },
        { "worker": "theone", "path": ["theone"] }
    ],
    "pathMap": {
        "raggy": "flora",
        "heugi": "flora",
        "mamura": "mamura",
        "swis": "swis",
        "theone": "theone"
    },
    "total": 17
}

The precise function of individual workers is not fully understood, but the number and diversity of named identifiers suggest they may serve as operator identifiers or routing keys, potentially allowing the backend to differentiate between distinct deployments or themes.

Pivoting on Backend Domains

The most recent phishing pages in the GSVerify cluster direct their API calls to a central backend domain, bestconnectapi[.]com. Scanning this domain directly returns an “access denied” response.

Examination of the response body reveals unusual JavaScript code designed to inject randomized noise content into the page to interfere with fingerprinting attempts.

Historical Themes and Additional Targets

Beyond YouTube-themed pages, the backend infrastructure associated with the GSVerify cluster has been observed serving phishing pages themed around well-known influencers and influencer-adjacent platforms.

MrBeast, one of the most widely followed content creators on YouTube:

Modash, an influencer analytics platform:

Brandley, a platform for connecting content creators with brands:

A variant using entirely Russian-language content was also identified. This page displays the following text, translated from Russian, regardless of the visitor’s browser language settings:

Suspicious activity has been detected on your account. Confirm your login to protect your account. Sign in with Google. Secure connection. Your data is safe.

This variant follows the same phishing flow as the YouTube-themed pages and communicates with the same backend domain. The end objective remains the same: obtaining persistent access to the victim’s Google account.

Screenshots from backend scans also indicate that this infrastructure has the capability to handle authentication flows beyond Google OAuth, with indicators of Apple and Microsoft sign-in support visible in the API responses. The urlscan Threat Research Team has not yet observed live phishing pages actively exercising these alternative authentication pathways.

The Knock Cluster

A second cluster was identified that employs the same YouTube copyright strike lure and BitB Google credential-harvesting flow. This cluster is distinguished by a distinctive API endpoint. Both this cluster and the GSVerify cluster reference a shared file associated with the /api/debug-alert path, suggesting a common codebase or shared development origin.

API Endpoints

The following API endpoints have been observed as part of this cluster:

• /api/yt/
• /api/strike-info
• /api/channel
• /api/knock
• /api/auth-success
• /api/debug-alert
• /verify/captcha

Enhanced BitB Modal

This cluster implements the same highly polished Google login modal as the GSVerify cluster. However, it goes further, by also simulating the browser permissions dropdown, an interface element present in real browsers that many users encounter infrequently. This additional layer of simulation reflects a deliberate effort to replicate every visual cue that might prompt a security-conscious user to question the authenticity of the window.

WebSocket Communications

Unlike the GSVerify cluster, which relies solely on HTTP API calls, the Knock cluster also uses WebSocket communications during the credential acquisition phase. This provides a persistent, bidirectional channel between the phishing frontend and the backend operator, enabling real-time relay of authentication data as the victim progresses through each stage of the flow.

Attribution Assessment

Several indicators within the code suggest the authors of this phishing setup are Russian-speaking. Russian-language comments are present throughout the JavaScript across both clusters, and Russian is configured as the first and default entry in the supported language set:

supportedLangs: ["ru", "en", "ua", "es", "fr", "ko", "ja"]

These indicators are not, however, sufficient to infer any particular geopolitical motivation or state affiliation, and no firm attribution to a specific threat actor or group is made at this time. Any such attribution would require corroboration with additional operational and intelligence data.

The Phishing Flow

Regardless of the underlying construction, both clusters follow the same general phishing flow. The process begins with an initial page themed around checking a YouTube channel for copyright strikes, a concern that is commonly faced by aspiring content creators.

When a channel name is provided, the page queries YouTube directly to validate the account and retrieve its subscriber count. Notably, any channel with more than three million subscribers does not advance to the next stage of the phishing flow; instead, it receives a benign message indicating that no copyright strikes were found. This threshold is enforced explicitly in the kit’s JavaScript:

const b = Number(h) > 3000000;

Here, h represents the subscriber count, and this cutoff is likely intended to avoid targeting accounts large enough to have additional platform protections in place, and to reduce the risk of drawing heightened attention.

For channels with fewer than three million subscribers, a fake copyright strike notification is displayed, instructing the user to sign into the Google account associated with the channel in order to resolve the issue.

Clicking the “Sign in with Google” button initiates a CAPTCHA challenge that the user must complete before proceeding.

After the user passes the CAPTCHA, a highly convincing modal iframe is presented. This technique, commonly known as BitB, was first documented and demonstrated by security researcher mr.d0x.

The technique has recently seen renewed interest within the security community: Kuba Gretzky, the author of the Evilginx adversary-in-the-middle framework, has announced that native BitB support is coming to an upcoming release of Evilginx Pro. The capabilities described in that announcement, including automatic detection of the visitor’s operating system and browser theme, a customizable address bar, and support for moving and resizing the simulated window, closely mirror what the urlscan Threat Research Team has observed in both clusters documented in this report. As the technique gains native support in widely used adversary simulation frameworks, defenders can expect to encounter it with increasing frequency.

The BitB modal in both clusters is styled to match the browser and operating system of the visiting user. The simulated address bar updates as the login flow progresses, and the modal can be closed or maximized. A reliable indicator that this is a BitB implementation rather than a genuine separate window is that it cannot be moved outside the boundaries of its parent window, nor viewed independently from it.

Both clusters have additionally implemented an interactive simulated SSL certificate screen, accessible by clicking the padlock icon in the fake address bar. This adds further credibility to the lure for users who check for that indicator as a sign of legitimacy.

At this stage, the phishing operates as an adversary-in-the-middle construct, relaying credentials and session tokens between the victim and Google’s legitimate authentication service. The range of authentication stages supported is visible in the kit’s JavaScript routing configuration:

const _0x587372 = {
  routes: {
    success: "success-confirmation",
    main: "main",
    prelogin: "prelogin",
    login: "login",
    password: "password",
    reject: "reject",
    choice: "choice",
    phoneconfirm: "phoneconfirm",
    pushmfa: "pushmfa",
    smscmfa: "smsCmfa",
    gauth: "gauth",
    emailbackmfa: "emailbackmfa",
    devicealt: "devicealt",
    sesionexpired: "SesionExpired",
    totp: "totp(authent)"
  }
};

This confirms the kit supports interception across multiple authentication pathways, including push-based MFA, SMS-based MFA, Google Authenticator, email backup codes, and time-based one-time passwords. Once the user completes the flow and submits their credentials, they are typically redirected to the legitimate YouTube website.

Conclusion

YouTube-themed credential harvesting has become an established phishing vector, exploiting the concerns of content creators through fake copyright strike notifications. This report documents two distinct but closely related phishing clusters both employing the same multi-stage lure to deliver a highly engineered BitB Google credential-harvesting flow.

Both clusters share a common phishing flow and likely a common codebase, yet each carries distinct infrastructure fingerprints that enable independent tracking. The subscriber count threshold used to filter prospective victims is a notable operational characteristic, reflecting a degree of deliberate selection beyond opportunistic credential harvesting. The urlscan Threat Research Team will continue to monitor both clusters as they evolve.

More on urlscan Pro

If you want to learn about the urlscan Pro platform and how it might be valuable for your organization feel free to reach out to us! We offer free trials with no strings attached. We would be happy to give you a passionate demo of what our platform can do for you. Reach out to us at sales@urlscan.io.