SamePath phishing kit
SamePath puts a fake Cloudflare human check in front of a phishing page and releases it by reloading the same URL after verification. We have matched it on 133 sites since 2 September.
SamePath in numbers
Since 2 September, the first SamePath match in our records, counted on 13 October 2026. How we count.
| Sites with SamePath code | 133 |
|---|---|
| Sites with a match in the last 30 days | 113 |
| New sites in September | 73 |
| Sites captured since 25 September | 40 |
A checkbox sends the page's verification code
SamePath shows a Cloudflare logo and a "Verify you are human" prompt. It chooses the prompt language from the browser's language settings. Clicking the checkbox starts a loading animation and sends a code already embedded in the page script.
The request posts to window.location.pathname with the fields __verify_submit and verify_code. It uses the X-Requested-With: XMLHttpRequest header and includes same-origin credentials.
A successful check releases the phishing page
The server's JSON response decides whether the browser proceeds. A success response calls window.location.reload(), which requests the original URL again and releases the phishing stage behind the gate. The visitor stays on the same address throughout the handoff.
When the response supplies a replacement verify_code, the script keeps it for the next click. A failed request resets the checkbox and loading state. The gate and the phishing page share a path, so preserving only the first response leaves out the content served after verification.
What we see
| Month | New sites |
|---|---|
| September | 73 |
| October so far | 60 |
Checking a SamePath gate
Keep the exact reported URL, the first response and the verification exchange. Look for:
- a checkbox with the id
verifyTrigger - a
verifyCodevalue embedded in the page script - a POST to the current path carrying
__verify_submitandverify_code - a replacement code read from
ret.data.verify_code - a reload after the server reports success
Check the response served after the reload as well as the gate. Remove both stages and the handler that accepts the verification code. Review hosting and deployment access and rotate the credentials that placed them.