Google sued the people behind it. The FBI, Google and Lumen's Black Lotus Labs announced a joint effort to tear down its infrastructure. Three weeks later, Group-IB's threat intelligence team received a text message, dressed up as Singapore's Land Transport Authority, that led straight back to the same phishing kit.
That kit is called Outsider (局外人), a phishing-as-a-service platform run by an operator known as ChenLun, and Group-IB researchers Viacheslav Shevchenko and Brandon Tan report in their new analysis that it never really stopped. Within a month of Google's June 12 civil lawsuit and the June 13 announcement of Operation Ghost Hook, they counted more than 700 new phishing pages built with it. Before the takedown it had tied more than 10,000 domains to the kit and, between December 2025 and May 2026, logged over 100,000 phishing pages across 54 or more countries.
A subscription and a Telegram channel
Outsider was sold through Telegram: an announcements channel run by ChenLun, a subscribers-only group for paying affiliates and a bot that handled purchases. Group-IB says the main group had more than 5,000 subscribers and over 230 paying users before it was suspended; ChenLun has since deleted the channel to stay out of sight.
What the money buys is 267 ready-made phishing templates, and counting, impersonating banks, brokerages, telecoms, postal and delivery firms, toll operators and government fine notices. Affiliates run it all from a web panel with a live map of victims and a no-code page editor.
The text tells you how to defeat your own phone
The campaigns arrive by SMS. In the Singapore case, the message warned of a pending "data synchronization" due by end of day. Because an iPhone can filter texts from unknown numbers and disable their links, the message even included step-by-step instructions for getting around that protection.
The cloned LTA site asked for a vehicle registration number and a phone number. The page exists only to harvest: the phone number is collected so that SMS one-time codes can be intercepted later. Victims were then told they owed a fee, threatened with penalties, and pushed to a card form. A fake payment gateway then served whatever second-factor challenge the targeted institution would normally use (an SMS code, an email code, a PIN or an app prompt), and operators can send a victim back to harvest a second card.
Every keystroke goes to the operator
The kit's main.js script streams what a victim types to the operator's panel as it is typed, so the data is captured even if the form is abandoned. Traffic is encrypted with AES-CTR through the browser's own Web Crypto API and carried over a WebSocket held open by a background worker, which is also how the operator pushes live instructions such as a fake validation error or a demand for a different card.
A server-side profile called GetSyncSetting runs the show: it can falsely reject the first card to get a second one, block security crawlers, and play an audio alert on the affiliate's dashboard whenever a victim types. Group-IB says that filename is unique to Outsider and can be used to attribute pages to the kit. The code also carries identifiers prefixed "JWR" (jwr_storage, JwrCrypto, JWRCID), the same branding Cisco Talos documented in August in a kit whose operators watch victims type in real time; Group-IB's report does not itself draw that link.
Track the file names, and never tap the link
For defenders, Group-IB's practical advice is to hunt for the kit's file-name signatures: every page follows an a_ to r_ prefix scheme that marks the victim's stage in the flow, and GetSyncSetting gives away the panel. For individuals the advice is older and still right: distrust urgent texts, do not follow their links, and check any claimed fine or fee in the official app. Singapore, where this sample was caught, has been reporting a steep rise in phishing cases.
A lawsuit and a coordinated takedown took the shop off the street. The product, on Group-IB's count, is still being sold.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.