TemplateHop phishing kit

TemplateHop is a redirector that picks a destination from an embedded URL pool while showing a loading animation. We have matched it on 46 sites since 13 September.

Research by Kirk

TemplateHop in numbers

Since 13 September, the first TemplateHop match in our records, counted on 13 October 2026. How we count.

Sites with TemplateHop code	46
Sites with a match in the last 30 days	46
New sites in September	29
Sites captured since 25 September	15

A loading animation hides a random redirect

TemplateHop's first page has a loading container and an array of animation templates between @LOADER_TEMPLATES_START and @LOADER_TEMPLATES_END comments. The script picks a template with Math.random() and writes it into loader-host.

A separate urls array holds the destinations. The page makes another random choice, waits briefly and assigns the selected address to window.location.href. Retained copies distribute visits across Vercel deployments with the same destination path.

The captured chain reaches a Meta appeal form

One retained redirect reaches gmic24whcg-h07g[.]vercel[.]app, then a page titled Meta Advertising Standards. It claims the visitor's ad account and pages are scheduled for deletion and asks them to appeal.

The page collects identity details, opens a password prompt and asks for authentication codes. Its flow-form.js sends the form, password and code through /submitForm, /submitPassword and /submit2FA requests to an operator API. Session polling controls password errors and the next authentication prompt.

What we see

Month	New sites
September	29
October so far	17

We have retained successful captures from 15 TemplateHop sites since 25 September.

Checking the loading page and its destination

Preserve the first response and the redirect chain. Look for:

@LOADER_TEMPLATES_START and @LOADER_TEMPLATES_END around an animation array
loader-host filled with a randomly selected template
an embedded urls array and a randomUrl chosen with Math.random()
a delayed window.location.href = randomUrl assignment
a Meta account-deletion or appeal page after the redirect
password and authentication-code requests tied to a session ID

Remove the loading page, destination form and operator API configuration from the deployment. Review hosting, DNS and deployment access and rotate their credentials.