VaultToken phishing kit

One campaign slug selects the landing page

VaultToken is a hosted device-code lure reached through a phishing link. Its page builds two API addresses from an apiBase and a campaign slug. The first ends in /api/v1/landing-pages/public/<slug>/init; the second uses the same path ending in /poll. The slug selects the campaign-specific landing page.

The page identifies its presentation as docusign-sso. It resembles a DocuSign single-sign-on step and gives the visitor a short code instead of asking for account credentials.

The copy event starts the polling loop

On load, initDeviceCode() asks the backend for a device code and expiry time. The page displays the code and records code_copied when the visitor copies it. The visitor then opens the legitimate device sign-in page, enters the code and approves the request.

At the same time, pollToken(iv, expiresIn) repeatedly calls the campaign's poll address until the code expires or the backend returns a token. A successful response records token_captured. Those two event names expose the operator's funnel: the code was copied, then the corresponding authorisation reached the backend.

The visitor completes authentication on the identity provider's device page. VaultToken's campaign API, template name and event tracking distinguish its own page.

What we see

Month	New sites
September	0
October so far	0

The latest VaultToken match in this snapshot was 26 August. The last 30 days contain 0 matches.

Checking a site for VaultToken

Open the exact link with developer tools recording requests. Look for:

• apiBase and slug combined into public landing-page API paths
• matching /init and /poll requests under the same campaign slug
• the docusign-sso template name
• initDeviceCode() followed by pollToken(iv, expiresIn)
• code_copied and token_captured event labels
• a displayed short code and a link to a legitimate device sign-in page

Remove the landing page and its campaign routes. Review the hosting account that published it, revoke the related identity sessions and rotate the site's deployment credentials.