Gcore phishing kit

Gcore is the name public research uses for browser-gated OAuth pages that submit a Turnstile response with an authorization-code request. We have matched it on 98 sites since 4 August.

Research by Kirk

Gcore in numbers

Since 4 August, the first Gcore match in our records, counted on 12 October 2026. How we count.

Sites with Gcore code	98
Sites with a match in the last 30 days	60
New sites in September	49
Sites captured since 25 September	26

A browser test controls the redirect

Gcore is the name this page family goes by in public research, not the Gcore cloud company. One component screens the browser before calling window.location.replace with its destination.

The script checks navigator.webdriver, PhantomJS and Nightmare globals, plus user-agent terms associated with headless browsers, command-line clients, scanners and link previews. It also tests WebGL, reported languages, the expected Chrome object and the battery API. The redirect runs after those checks pass.

Turnstile submits the OAuth request

The captured page is a compact interstitial titled "One more step...". It places Cloudflare Turnstile above a form whose action is an /oauth/authorize URL.

When Turnstile succeeds, the callback removes any earlier response field, inserts the current token and submits the form immediately. Widget errors are posted to /captcha-widget-error as an event value.

The authorization request uses response_type=code, an HTTPS callback and scopes named channels:read and chat:write. Those scopes request access to list channels and post chat messages. The client ID, callback, state, Turnstile site key and random query value can change between deployments.

The earliest and latest retained bodies we reviewed, from 1 September and 9 October, kept the same HTML structure and callback logic. Their mutable OAuth and Turnstile values changed, which makes the form behaviour a stronger family marker than any single embedded value.

What we see

Month	New sites
September	49
October so far	23

Among successful captures since 25 September, 0 of 26 Gcore sites ran WordPress.

Checking a Gcore page

Preserve the initial response and the form action. Look for:

checks for WebDriver, PhantomJS, Nightmare, crawler names or missing browser features
window.location.replace after the browser tests
a Turnstile callback that creates a response input and submits immediately
an /oauth/authorize action with response_type=code
channels:read and chat:write in the requested scope
error reports posted to /captcha-widget-error

Remove the gate and consent page. Revoke the application registration and review the hosting and deployment accounts that created them.