A sophisticated Adversary-in-the-Middle (AiTM) phishing framework named Blacksite, integrated with the Cloaked.gg bot evasion engine, has emerged on cybercriminal forums. Exploiting standard session validation, this service intercepts credentials and session tokens to orchestrate stealthy corporate account takeovers.
The cybercriminal underground marked a major shift in threat accessibility with the commercial release of Blacksite, a highly automated Adversary-in-the-Middle (AiTM) phishing framework developed and sold by the threat actor known as kirapayload. Advertised on premier Russian-speaking underground forums, this framework lowers the operational barrier for executing complex corporate credential theft, session hijacking, and multi-factor authentication (MFA) bypass campaigns. By mirroring target platforms in real-time, Blacksite allows operators to intercept active sessions, undermining standard access controls across enterprise Single Sign-On (SSO), financial systems, and cryptocurrency platforms.
Unlike traditional phishing setups that rely on static, easily spotted templates, the Blacksite framework represents a dangerous evolution in Phishing-as-a-Service (PhaaS). Its developer offers the tool on a subscription basis, marketing it alongside specialized evasive utilities designed to mask the threat from automated scanning engines. For organizations across the GCC region, this development signifies that traditional perimeter protections and standard push-notification MFA are no longer sufficient to guarantee identity security.
Attackers send link via phishing email, SMS, or QR code
Cloaked.gg filters incoming requests to deflect sandboxes & scanners
Genuine targets receive live mirrored login pages in real-time
Attackers capture credentials and bypass active MFA checks
Stolen cookies are replayed via residential geo-matched proxies
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
Threat actors are distributing advanced phishing and credit card harvesting toolkits designed to exploit payment gateways. Learn how these threats impact your enterprise and how to defend your infrastructure.
A localized business email compromise at an Australian healthcare provider has exposed sensitive patient communications and Department of Veterans' Affairs (DVA) ID numbers from an active shared mailbox. Learn how credential-harvesting attacks bypass legacy controls and how to secure cloud email environments.
Technical analysis of Jalisco and OmegaLord, two advanced phishing kits designed to exploit the OAuth 2.0 Device Authorization Grant and bypass multi-factor authentication, leading to rapid SaaS data exfiltration within minutes of initial access.
Mitigating advanced threats like Blacksite requires offensive security verification and active intelligence. Standard security policies cannot protect against adversaries who bypass authentication controls through dynamic reverse proxies. A comprehensive assessment of your external exposure is necessary to close security gaps before attackers can exploit them.
FemtoSec delivers specialized offensive capabilities designed to find, test, and harden your organization against modern session hijacking and credential harvesting frameworks. Through our comprehensive Penetration Testing services, we actively simulate advanced AiTM phishing scenarios and validation bypasses within your specific network and identity environments. This proactive testing helps you discover structural weaknesses in your access policies, application architectures, and perimeter controls. By combining tactical offensive testing with continuous intelligence through Dark Web Monitoring, we ensure your organization is equipped to preempt cybercriminal frameworks before they compromise your operational integrity.
The operational framework of Blacksite relies on a highly structured containerized architecture using Docker backends and Nginx reverse proxies. Rather than attempting to spoof complex corporate login pages, the system acts as an interactive proxy that sits directly between the victim and the legitimate service provider. This mechanism executes a highly organized step-by-step attack sequence that proceeds as follows:
Attackers distribute malicious URLs through standard vectors, including spear-phishing emails, tailored SMS messages, and QR codes. These links point to infrastructure controlled by the attacker, which is dynamically routed using the framework backend.
Before a visitor is allowed to interact with the phishing framework, the traffic is routed through Cloaked.gg, a sophisticated bot evasion and cloaking platform developed by the same author. This stage determines whether the connection is a real target or an automated security crawler.
If the visitor is validated as a legitimate human target, the Nginx reverse proxy mirrors the target website in real-time. When the user inputs their username and password, the data is captured. When the legitimate server issues an MFA challenge (such as a time-based one-time password or push challenge), the proxy forwards the prompt to the victim. Once completed, the victim is successfully authenticated to the real service, while the proxy intercepts the resulting session cookies and OAuth tokens.
The stolen authentication tokens are instantly uploaded to an attacker dashboard. To bypass location-based alerts or anomalous access controls, the attacker clones the victim's exact browser fingerprint and replays the session using a geographically matched residential proxy matching the victim's physical area.
[Target Clicks Link] -> [Evasion Check (Cloaked.gg)]
|
+----------------------+----------------------+
| (Automated Crawler) | (Real Victim)
v v
[Serve Safe Decoy Page] [Mirror Login via Nginx Proxy]
(e.g., Charliesdemons.com) |
v
[Intercept Credentials & MFA]
|
v
[Extract Stolen Session Cookies]
|
v
[Replay Session via Resident Proxy]A critical component of the Blacksite package is its integration with the Cloaked.gg evasion engine, which has been active in underground circles since late 2025. This bot-mitigation platform acts as an automated gatekeeper. It analyzes incoming traffic based on several strict variables to prevent cybersecurity scanners, sandboxes, and automated cloud crawlers from detecting the phishing infrastructure.
Cloaked.gg filters requests using a combination of techniques:
Targeted ASN Blocking: The platform hard-blocks traffic originating from major cloud hosting networks and datacenter Autonomous System Numbers (ASNs), including those associated with AWS, Google Cloud, and Microsoft Azure.
TLS Fingerprinting: It evaluates JA3 and JA4 TLS fingerprints to identify automated headless browsers and security validation scripts.
Geographic and Proxy Intelligence: Incoming connections using known corporate VPNs, Tor exit nodes, or public proxies are routinely deflected or barred.
Dual-View Storefront Redirection: While automated crawlers are served standard HTTP 403 Forbidden screens or completely benign storefronts (such as the AI-generated donut shop template on charliesdemons.com), human targets on standard residential or enterprise ISP networks bypass these checks to access the live phishing proxy.
For modern enterprises, the primary risk of frameworks like Blacksite is the shift from static credential harvesting to dynamic session hijacking. When an attacker steals a valid session cookie, they bypass the authentication process entirely. Because the session has already been validated, the attacker does not need to know the victim's password or possess their MFA device. This access allows threat actors to establish immediate persistence within corporate directories, search sensitive mailboxes, exfiltrate private databases, and perform lateral movement.
This bypass capability nullifies basic security awareness efforts that instruct employees to look out for MFA prompts, as the victim undergoes what appears to be a completely legitimate authentication flow. Furthermore, because the attacker uses residentially matched proxy routing, standard automated identity protection systems often fail to flag the hijacked session as anomalous.
To understand if corporate identities or domain details have already been compromised and exposed on underground criminal networks hosting these platforms, proactive organizations should utilize targeted diagnostic tools. GCC-based enterprises can run a rapid validation scan. Use FemtoSec's Dark Web Scanner to check dark web mentions, compromised account indicators, malware log signals, public breach exposure, and recent underground market activity for your domain. Implementing this quick check helps establish a baseline before deploying advanced, ongoing mitigation strategies.
Detecting and neutralizing stealthy AiTM frameworks requires a multi-layered defensive strategy that shifts security posture from perimeter validation to cryptographic verification.
Security Operations Centers (SOCs) should configure behavioral monitoring rules specifically designed to catch session reuse. Analyze your identity logs for cases where an authentication event occurs on one ISP or ASN, but subsequent API calls or resource access on that exact session occur from a completely different ASN, hosting range, or device fingerprint. Track impossible travel alerts, such as a session being initiated in Dubai and executing tasks from a residential proxy pool in another region minutes later.
Security teams must train their incident response professionals to look past clean sandbox verdicts. When automated scanners return benign results for a suspected phishing URL, analysts should manually validate the endpoint using isolated commercial mobile networks or residential proxy setups. Standard user-agent modifications and human-like interaction emulation are critical to bypassing Cloaked.gg filters and revealing the underlying phishing framework.
Standard multi-factor authentication, such as SMS OTPs and push notifications, is fundamentally vulnerable to reverse proxy interception. Organizations must prioritize transitioning to phishing-resistant authentication methods. Protocols like FIDO2/WebAuthn hardware keys (such as YubiKeys) or Certificate-Based Authentication (CBA) cryptographically bind the login credential to the origin domain. Because the cryptographic handshake occurs directly between the browser and the legitimate domain, it cannot be proxied by an intermediary server like Blacksite.
Enforce policies that evaluate access tokens dynamically. By integrating Continuous Access Evaluation (CAE), identity engines can instantly revoke active sessions if critical security telemetry changes, such as a change in network location, device compliance state, or password reset. Reducing the maximum lifespan of access cookies and enforcing strict idle session timeouts can significantly limit the operational window available to an attacker holding a hijacked cookie.