PassTwice phishing kit
PassTwice uses fake Meta verification and appeal pages to collect identity details, repeated passwords and MFA codes. We have matched it on 134 sites since 31 August.
PassTwice in numbers
Since 31 August, the first PassTwice match in our records, counted on 13 October 2026. How we count.
| Sites with PassTwice code | 134 |
|---|---|
| Sites with a match in the last 30 days | 94 |
| New sites in September | 118 |
| Sites captured since 25 September | 34 |
A badge or appeal lure opens the form
PassTwice presents a Meta verification request or account appeal. One lure mixes a blue-badge offer with advertiser invoicing and opens the collection form from a "Submit request" button. The form asks for a name, personal and business email addresses, page name, phone number and date of birth before it asks for a password.
The captured page loads app.js for the form sequence and utils.js for storage and delivery. Those scripts keep the identity details attached to every later password and code attempt.
Rejection messages collect another attempt
The first password submission is saved and sent to the operator. Then the script clears the field and displays an incorrect-password message. The next submission is saved as passwordSecond, and the page opens its MFA form.
The MFA prompt repeats the visitor's masked email address and phone number and asks for a code from an authenticator or message. Early submissions trigger an incorrect-code message and a countdown before another attempt. The script keeps the values as twoFa, twoFaSecond and twoFaThird, sends the accumulated record after each submission, then displays a request-received message with a link to Facebook.
The rejection messages follow counters in the page script. They appear after the data has already been sent.
The browser keeps and sends the record
The storage helper AES-encrypts the accumulated record in local storage under keys such as __client_rec__se_con. The notification helper adds IP-location details and sends the record to Telegram, EmailJS or both, according to the configuration. Telegram reports include the labels Email Business:, Page Name:, Password(2): and Code 2FA(3):.
What we see
| Month | New sites |
|---|---|
| September | 118 |
| October so far | 13 |
Checking a PassTwice page
Keep the lure HTML and the form, configuration and notification scripts. Look for:
- a Meta badge or appeal page collecting business identity before the password
Utils.saveRecordand local-storage keys starting with__client_rec__- password and code fields cleared after the notification helper runs
passwordSecond,twoFaSecondandtwoFaThirdin the accumulated record- Telegram or EmailJS delivery containing the identity, password and code fields
Remove the lure and its scripts, including the delivery configuration. Review hosting and deployment access and rotate the credentials that placed the files.