Request an evaluation
Menu

Web threats / Phishing kits

NexoSiren phishing kit

NexoSiren uses fake document, message and account pages to collect browser details, location and camera and microphone recordings. We have matched it on 5 sites since 11 October.

Research by Kirk

NexoSiren in numbers

Since 11 October, the first NexoSiren match in our records, counted on 13 October 2026. How we count.

Sites with NexoSiren code5
Latest match12 October
Sites captured since 25 September1

The operator selects the brand remotely

NexoSiren pages carry the markers NEXO_SLUG, NEXO_RELAY_TOKEN and PAINEL NEXO. Each page requests its campaign configuration from hxxps://nexo-cfg[.]pages[.]dev/[campaign].json. The response chooses the brand, button text and collection settings, so the operator changes the next visitor's page without republishing it.

The templates copy Google Drive, WhatsApp, Instagram, Netflix and shopping services. Their prompts offer a shared file, voice message, story, coupon or account check. The same collection script runs behind these different lures.

The page requests access to the visitor's devices

The page automatically clicks its own consent button, then requests location, camera and microphone access through the browser. It queries an IP-location service and records the browser, operating system, screen dimensions, language, CPU and memory details. WebGL reveals the graphics renderer, and a canvas drawing supplies another browser fingerprint.

When the visitor grants camera and microphone access, the script takes camera photos and records audio. Its live mode keeps sending new photos and audio fragments while the page stays open. Telegram receives the media through sendPhoto, sendAudio and sendDocument, alongside messages containing the visitor's device and location details. The script reports when the page closes and asks the browser to keep the screen awake during collection.

An off-screen form adds username and password fields with browser autofill attributes. It posts to hxxps://painel-nexo[.]pages[.]dev/api/gather with the campaign slug.

Checking a NexoSiren page

Preserve the initial HTML, permission prompts and network log. Look for:

  • NEXO_SLUG, NEXO_RELAY_TOKEN and PAINEL NEXO in the page script
  • a campaign JSON request to nexo-cfg[.]pages[.]dev
  • a consent button clicked by the page's own script
  • location and media permission requests on a document, message or account lure
  • repeated Telegram photo, audio or document uploads
  • an off-screen login form posting to the panel's /api/gather route

Remove the page and its campaign configuration. Review hosting and deployment access and rotate the credentials that placed them.