TurnShade phishing kit

TurnShade puts a Cloudflare Turnstile challenge in front of a counterfeit Microsoft sharing page and carries the visitor's original path through verification. We have matched it on 114 sites since 10 September.

Research by Kirk

TurnShade in numbers

Since 10 September, the first TurnShade match in our records, counted on 13 October 2026. How we count.

Sites with TurnShade code	114
Sites with a match in the last 30 days	19
New sites in September	110
Sites captured since 25 September	6

Turnstile carries the original path forward

TurnShade opens with a verification page containing a Cloudflare Turnstile widget. A hidden originalPath field keeps the path the visitor requested. Once Turnstile returns a token, the success callback displays a spinner, creates another hidden field and submits the form to the site's root with a GET request.

The script constructs the token field's name, cf-turnstile-response, from character codes and arithmetic. It splits method names such as appendChild and submit into string fragments. The resulting request carries both the challenge token and the original path.

Browser checks run beside the challenge

The gate loads /public/js/t.js, which collects the graphics renderer, platform, languages, screen dimensions, plugins, touch support, CPU and memory details. It also checks battery, WebSocket and service-worker support. The script posts that record to /api/t; a flagged response reloads the page.

A captured gate blocks context menus, text selection and developer-tool shortcuts. Its debugger timing check clears the document and sends the browser to about:blank when execution pauses long enough.

The verification handoff releases a counterfeit Microsoft sharing page that asks for an email address. Its form handler XOR-encodes the address, Base64-encodes the result and places it in a hidden same-origin submission. The address continues through the next request as an email query value.

What we see

Month	New sites
September	110
October so far	4

Checking a TurnShade gate

Preserve the challenge page and the requests after verification. Look for:

turnstileForm with a hidden originalPath field
a character-code array named _xncf in onTurnstileSuccess
/public/js/t.js sending browser details to /api/t
a GET to the root carrying the original path and Turnstile response
a Microsoft sharing form using txtTOAAEmail, encryptedData and btnSubmitEmail

Remove the gate, browser probe and sharing-page handler. Review hosting and deployment access and rotate the credentials that placed them.