NakedPages phishing kit
NakedPages is a phishing toolkit with a bidirectional browser relay, direct credential collectors and a detailed fingerprint gate. We have matched it on 69 sites since 28 August.
NakedPages in numbers
Since 28 August, the first NakedPages match in our records, counted on 12 October 2026. How we count.
| Sites with NakedPages code | 69 |
|---|---|
| Sites with a match in the last 30 days | 50 |
| New sites in September | 42 |
| Sites captured since 25 September | 24 |
A login page rendered from the other end
CloudSEK introduced the name NakedPages after finding the Node.js toolkit advertised on a cybercrime forum in 2022. The seller described a reverse-proxy product with ready-made templates. The code in our captures shows a more distinctive implementation: one branch builds the visible sign-in page from DOM updates sent over Socket.IO.
The page begins as a shell. It loads the Socket.IO client, domdiffer.js and an empty application container. A domchanges message supplies the next piece of the page, including content inside nested frames. The visitor sees a working sign-in flow even though the operator controls the document from the other end of the connection.
Every interaction returns through the socket
The relay works in both directions. Native clicks and form submissions are intercepted and sent to the server. Input, paste, keypress and text-selection handlers report the current value and details about the field. Server messages can change the browser URL, reset the document, redirect the visitor or hold the page during an authentication step.
Before that relay, one captured gate inventories properties exposed by the browser, screen, document and console. It records the time zone, WebGL vendor and renderer, and WebRTC connection details. After a minimum delay, it submits the result through a hidden form with the page path and hash.
NakedPages also appears in simpler stages. A direct collector sends email, password, CAPTCHA and device data over Socket.IO. A recent document-themed page only checked the email format, added the address to the next URL and handed the visitor to another site. These stages explain why a NakedPages match can be a gate or collector rather than the live DOM shell itself.
What we see
| Month | New sites |
|---|---|
| September | 42 |
| October so far | 24 |
We captured 24 NakedPages sites since 25 September. 0 of them were running WordPress.
Finding the relay in a site copy
Save the exact page source, loaded scripts and WebSocket traffic while using test values. The strongest combination is Socket.IO beside domdiffer.js, an initially empty application container, and messages named domchanges and inputchange. Also search for handlers that send paste, selection, keypress, click and submit events, plus server handlers for domreset, redir, authhold or updateBrowserUrl.
For the gate, look for a hidden form carrying a large browser inventory together with WebGL and WebRTC results. On simpler collectors, follow the code that creates a device identifier, writes a long-lived cookie and emits form values as a socket event.