OmegaLord phishing kit
OmegaLord is a JavaScript phishing kit with sign-in and payment collection pages. We have matched it on 7 sites since 4 September.
OmegaLord in numbers
Since 4 September, the first OmegaLord match in our records, counted on 12 October 2026. How we count.
| Sites with OmegaLord code | 7 |
|---|---|
| Sites with a match in the last 30 days | 5 |
| New sites in September | 7 |
| Last match | 21 September |
The PDF prompt asks for a phone number too
ReliaQuest named OmegaLord in July 2026 after finding it in hosted HTML and file-sharing links. The lure presents a PDF reader sign-in, validates the visitor's email address and then submits the password and phone number.
The phone field is a useful distinction from common two-field credential forms. ReliaQuest assesses it as support for intercepting or hijacking MFA requests.
A second page imitates payment verification
The payment build asks for card details, a phone number and the one-time code sent to approve a payment. Its script also retrieves the visitor's public IP address and sends the collected fields to a Telegram destination.
Both OmegaLord page types hide their logic in self-defending JavaScript. The sign-in build reconstructs source with decodeURI and String.fromCharCode, passes it to eval and raises Error: the code has been tampered! when the wrapper changes. The payment build stores important strings as URL-encoded, XOR-obfuscated data, including the IP lookup and Telegram paths. Its wrapper derives a repeating key from its own function text before decoding and evaluating the main script.
The wrapper grew while the collection markers stayed stable
Our first September payment copy was about 121 KB. Three copies captured later in the month were about 173 KB to 181 KB, with changes in the encoded body and surrounding wrapper. The encoded markers for the IP lookup, Telegram submission and OmegaLord identity remained consistent. A 121,533-byte package seen on 11 September returned unchanged on 21 September, after the larger variants appeared.
What we see
| Month | New sites |
|---|---|
| September | 7 |
| October so far | 0 |
The latest OmegaLord match in this snapshot was 21 September. 5 sites matched in the last 30 days.
Checking a site for OmegaLord
Inspect linked HTML files and inline scripts. Look for:
- a PDF reader sign-in that asks for email, password and phone number
- payment fields followed by a one-time-code step
Array.prototype.slice.call(arguments)around anevalwrapperdecodeURI,String.fromCharCodeand the tamper error together- long URL-encoded strings decoded with a repeating XOR operation
- code that combines an IP lookup with a Telegram submission
Remove the pages and their submission routes. Review the hosting or file-sharing account that published them and rotate its credentials.