MassCollect phishing kit
MassCollect is our name for generated login pages that send each login to a same-origin collector and then force another attempt. We have matched it on 3,900 sites since 2 October.
MassCollect in numbers
Since 2 October, the first MassCollect match in our records, counted on 12 October 2026. How we count.
| Sites with MassCollect code | 3,900 |
|---|---|
| Sites with a match in the last 30 days | 3,900 |
| New sites in October so far | 3,900 |
| Sites captured since 25 September | 1,668 |
A generated batch with one collection path
MassCollect is our name for two self-contained login templates deployed as complete HTML pages. Their titles and labels pose as file exchanges, remote-access gateways, monitoring dashboards and support consoles. The form, styling and collection code arrive together in one response.
Both templates send the entered identity and password to /api/v1/authenticate on the page's own host. They differ enough to look like separate products while preserving the same collection loop.
The file portal ignores every answer
The first template presents a compact file or remote-access login. Its fields use the short names u and p. Before submission, the script makes a fingerprint by Base64-encoding the browser's user agent with the current time and places it in a hidden field.
The form is sent as multipart data after a short randomized delay. The script discards the server's response, advances through connection and verification messages, then displays an invalid-password error. It clears the password and returns the cursor to that field.
The console template reads status codes
The second template looks like an edge, cache or administration console. It generates element IDs when the page loads and sends JSON containing identity, credential, csrf_token and client_timestamp.
Responses with status 400, 401 or 403 can supply the error shown to the visitor. Other failures become a gateway, timeout or invalid-credentials message. Every branch ends at the same form with an empty password field, ready to collect another attempt.
The two implementations expose a useful boundary for investigation: visual text changes across copies, while the same-origin path, request fields and forced retry stay stable.
What we see
| Month | New sites |
|---|---|
| September | 0 |
| October so far | 3,900 |
Among successful captures since 25 September, 0 of 1,668 MassCollect sites ran WordPress.
Checking a MassCollect page
Open the reported path with test values and preserve the response body and network log. Look for:
- a POST to
/api/v1/authenticateon the page's own host - multipart fields named
u,pandfingerprint - a fingerprint built from
navigator.userAgentandDate.now() - a JSON request containing
identity,credential,csrf_tokenandclient_timestamp - generated element IDs or a randomized delay immediately before submission
- code that shows an error, clears the password and focuses the field after every result
Remove the page and its same-origin handler. Review the hosting and deployment accounts and rotate their credentials.