Miarroba phishing kit
Miarroba is our label for several Spanish-language phishing page chains found on the same free-hosting service. We have matched their distinct code patterns on 60 sites since 10 August.
Miarroba in numbers
Since 10 August, the first Miarroba match in our records, counted on 12 October 2026. How we count.
| Sites with Miarroba code | 60 |
|---|---|
| Sites with a match in the last 30 days | 26 |
| New sites in September | 27 |
| Sites captured since 25 September | 10 |
Our label covers several Spanish page chains
Miarroba is Ohey's label for distinct Spanish-language phishing implementations found on one free-hosting service. The hosting provider inserts its own advertising and visitor-counter code into these pages. That shared wrapper is useful context, but the family match comes from the phishing code inside it. The implementations include Microsoft account pages, bank forms and a longer chain that updates one Discord message throughout the visit.
This distinction matters during review. A provider banner or counter alone does not connect a page to the collection code described here, and the different Miarroba branches do not form one continuous visitor journey.
One Discord record grows across three stages
The longest captured chain begins with a Spanish Microsoft sign-in. It stores the email and password in local storage, sends them to a Discord webhook with ?wait=true, then saves the returned message identifier as msg_id.
The next page describes a facial check. It requests the camera, draws two frames to a canvas and attaches them as foto1.png and foto2.png by updating the same Discord message. A payment page follows. It saves the cardholder, card number, expiry and CVV under keys beginning with tarjeta_, then updates that message again or creates a replacement if the identifier is missing. The last redirect opens the real Outlook inbox.
Recent pages use short local handoffs
Other captures stop after a much smaller step. One page presents a Spanish Microsoft terms notice and moves the visitor to a local index05 page. Another accepts only Hotmail, Outlook, Live and MSN addresses, encodes the email and passes it to index2. A bank-themed page asks the visitor to select a loan amount, then hands that choice to the next local page.
A separate Microsoft collector calls a visitor-location service, combines the returned IP, city and country with the submitted credentials, and sends the report through the Telegram Bot API with Axios. This collector is its own branch; it is not evidence that the Discord, bank and local-handoff pages share one backend.
What we see
| Month | New sites |
|---|---|
| September | 27 |
| October so far | 5 |
We captured 10 Miarroba sites since 25 September. 0 of them were running WordPress. Of the 1 site recaptured after at least 25 days, 0 still matched.
Separating the branches in a site copy
Save every local page. On the short-handoff branches, the first form reveals only the next filename. For the Discord chain, search for msg_id, ?wait=true, PATCH requests, camera canvas exports named foto1.png and foto2.png, and local-storage keys beginning with tarjeta_. For the shorter branches, follow index2, index05 and other local form actions. Treat direct Telegram requests, location lookups and Axios imports as evidence for that collector only.