Blacksite Phishing Framework Bypasses MFA via Cloaked

The Commercial Launch of the Blacksite Phishing Engine

The cybercriminal underground marked a major shift in threat accessibility with the commercial release of Blacksite, a highly automated Adversary-in-the-Middle (AiTM) phishing framework developed and sold by the threat actor known as kirapayload. Advertised on premier Russian-speaking underground forums, this framework lowers the operational barrier for executing complex corporate credential theft, session hijacking, and multi-factor authentication (MFA) bypass campaigns. By mirroring target platforms in real-time, Blacksite allows operators to intercept active sessions, undermining standard access controls across enterprise Single Sign-On (SSO), financial systems, and cryptocurrency platforms.

Defensive Integration with FemtoSec

Mitigating advanced threats like Blacksite requires offensive security verification and active intelligence. Standard security policies cannot protect against adversaries who bypass authentication controls through dynamic reverse proxies. A comprehensive assessment of your external exposure is necessary to close security gaps before attackers can exploit them.

FemtoSec delivers specialized offensive capabilities designed to find, test, and harden your organization against modern session hijacking and credential harvesting frameworks. Through our comprehensive Penetration Testing services, we actively simulate advanced AiTM phishing scenarios and validation bypasses within your specific network and identity environments. This proactive testing helps you discover structural weaknesses in your access policies, application architectures, and perimeter controls. By combining tactical offensive testing with continuous intelligence through Dark Web Monitoring, we ensure your organization is equipped to preempt cybercriminal frameworks before they compromise your operational integrity.

Technical Deep Dive: The Adversary-in-the-Middle Attack Chain

The operational framework of Blacksite relies on a highly structured containerized architecture using Docker backends and Nginx reverse proxies. Rather than attempting to spoof complex corporate login pages, the system acts as an interactive proxy that sits directly between the victim and the legitimate service provider. This mechanism executes a highly organized step-by-step attack sequence that proceeds as follows:

Step 1: Initial Access Delivery

Attackers distribute malicious URLs through standard vectors, including spear-phishing emails, tailored SMS messages, and QR codes. These links point to infrastructure controlled by the attacker, which is dynamically routed using the framework backend.

Step 2: Traffic Segmentation and Evasion

Before a visitor is allowed to interact with the phishing framework, the traffic is routed through Cloaked.gg, a sophisticated bot evasion and cloaking platform developed by the same author. This stage determines whether the connection is a real target or an automated security crawler.

Step 3: Real-Time Mirroring and MFA Interception

If the visitor is validated as a legitimate human target, the Nginx reverse proxy mirrors the target website in real-time. When the user inputs their username and password, the data is captured. When the legitimate server issues an MFA challenge (such as a time-based one-time password or push challenge), the proxy forwards the prompt to the victim. Once completed, the victim is successfully authenticated to the real service, while the proxy intercepts the resulting session cookies and OAuth tokens.

Step 4: Session Hijacking and Persistent Access

The stolen authentication tokens are instantly uploaded to an attacker dashboard. To bypass location-based alerts or anomalous access controls, the attacker clones the victim's exact browser fingerprint and replays the session using a geographically matched residential proxy matching the victim's physical area.

[Target Clicks Link] -> [Evasion Check (Cloaked.gg)]
                              |
       +----------------------+----------------------+
       | (Automated Crawler)                         | (Real Victim)
       v                                             v
[Serve Safe Decoy Page]                  [Mirror Login via Nginx Proxy]
(e.g., Charliesdemons.com)                           |
                                                     v
                                         [Intercept Credentials & MFA]
                                                     |
                                                     v
                                         [Extract Stolen Session Cookies]
                                                     |
                                                     v
                                         [Replay Session via Resident Proxy]

The Mechanics of Cloaked.gg Evasion

A critical component of the Blacksite package is its integration with the Cloaked.gg evasion engine, which has been active in underground circles since late 2025. This bot-mitigation platform acts as an automated gatekeeper. It analyzes incoming traffic based on several strict variables to prevent cybersecurity scanners, sandboxes, and automated cloud crawlers from detecting the phishing infrastructure.

Cloaked.gg filters requests using a combination of techniques:

• Targeted ASN Blocking: The platform hard-blocks traffic originating from major cloud hosting networks and datacenter Autonomous System Numbers (ASNs), including those associated with AWS, Google Cloud, and Microsoft Azure.

• TLS Fingerprinting: It evaluates JA3 and JA4 TLS fingerprints to identify automated headless browsers and security validation scripts.

• Geographic and Proxy Intelligence: Incoming connections using known corporate VPNs, Tor exit nodes, or public proxies are routinely deflected or barred.

• Dual-View Storefront Redirection: While automated crawlers are served standard HTTP 403 Forbidden screens or completely benign storefronts (such as the AI-generated donut shop template on charliesdemons.com), human targets on standard residential or enterprise ISP networks bypass these checks to access the live phishing proxy.

The Enterprise Impact: Moving Beyond Traditional Credential Theft

For modern enterprises, the primary risk of frameworks like Blacksite is the shift from static credential harvesting to dynamic session hijacking. When an attacker steals a valid session cookie, they bypass the authentication process entirely. Because the session has already been validated, the attacker does not need to know the victim's password or possess their MFA device. This access allows threat actors to establish immediate persistence within corporate directories, search sensitive mailboxes, exfiltrate private databases, and perform lateral movement.

This bypass capability nullifies basic security awareness efforts that instruct employees to look out for MFA prompts, as the victim undergoes what appears to be a completely legitimate authentication flow. Furthermore, because the attacker uses residentially matched proxy routing, standard automated identity protection systems often fail to flag the hijacked session as anomalous.

To understand if corporate identities or domain details have already been compromised and exposed on underground criminal networks hosting these platforms, proactive organizations should utilize targeted diagnostic tools. GCC-based enterprises can run a rapid validation scan. Use FemtoSec's Dark Web Scanner to check dark web mentions, compromised account indicators, malware log signals, public breach exposure, and recent underground market activity for your domain. Implementing this quick check helps establish a baseline before deploying advanced, ongoing mitigation strategies.

Detection, Validation, and Tactical Containment Guidance

Detecting and neutralizing stealthy AiTM frameworks requires a multi-layered defensive strategy that shifts security posture from perimeter validation to cryptographic verification.

1. Behavioral Post-Authentication Audits

Security Operations Centers (SOCs) should configure behavioral monitoring rules specifically designed to catch session reuse. Analyze your identity logs for cases where an authentication event occurs on one ISP or ASN, but subsequent API calls or resource access on that exact session occur from a completely different ASN, hosting range, or device fingerprint. Track impossible travel alerts, such as a session being initiated in Dubai and executing tasks from a residential proxy pool in another region minutes later.

2. Defeating Cloaked Landing Pages

Security teams must train their incident response professionals to look past clean sandbox verdicts. When automated scanners return benign results for a suspected phishing URL, analysts should manually validate the endpoint using isolated commercial mobile networks or residential proxy setups. Standard user-agent modifications and human-like interaction emulation are critical to bypassing Cloaked.gg filters and revealing the underlying phishing framework.

3. Implementing Phishing-Resistant MFA

Standard multi-factor authentication, such as SMS OTPs and push notifications, is fundamentally vulnerable to reverse proxy interception. Organizations must prioritize transitioning to phishing-resistant authentication methods. Protocols like FIDO2/WebAuthn hardware keys (such as YubiKeys) or Certificate-Based Authentication (CBA) cryptographically bind the login credential to the origin domain. Because the cryptographic handshake occurs directly between the browser and the legitimate domain, it cannot be proxied by an intermediary server like Blacksite.

4. Active Session Lifetimes and Continuous Evaluation

Enforce policies that evaluate access tokens dynamically. By integrating Continuous Access Evaluation (CAE), identity engines can instantly revoke active sessions if critical security telemetry changes, such as a change in network location, device compliance state, or password reset. Reducing the maximum lifespan of access cookies and enforcing strict idle session timeouts can significantly limit the operational window available to an attacker holding a hijacked cookie.