urlscan.io Blog
About
The urlscan.io Blog covers announcements, product news, and tutorials.
Contact
You can contact us at info@urlscan.io for general inquiries and at sales@urlscan.io for questions around our commercial products.
If you need technical support contact us at support@urlscan.io.
For matters of security, please see our Security Page.
Updates
For updates and announcements, subscribe to our newsletter.
Follow us on Twitter:
Highlights
Announcing urlscan Labs
We just launched the urlscan Labs umbrella in our urlscan Pro platform. With this post, we wanted to give our users some background about what we have launched as part...
Intel Brief: Caught in the Crossfire - When an AI Agent Swarm Uses Your Infrastructure to Attack
For approximately 48 hours in June 2026, a cluster of activity that the urlscan Threat Research Team assesses to be a swarm of automated AI agents used urlscan.io as a...
FluxPanel and FastFlux
Nameserver Pivoting Uncovers a UK Banking Phishing Network
The urlscan Threat Research Team identified a suspicious IP address hosting a cluster of phishing sites predominantly targeting UK banks, including HSBC, Lloyds, Metro Bank, Barclays, and Revolut. Pivoting from...
All Posts
Influencer Phishing
Google Account Credential Harvesting via YouTube Lures
This report documents two closely related phishing clusters identified by the urlscan Threat Research Team, both targeting social media users, primarily YouTube content creators, with the goal of gaining access...
Shared Phishing Framework
Impersonating Prove and Multiple Financial Brands
The urlscan Threat Research Team identified a phishing site impersonating Prove, an identity verification provider, which stood out due to the notable nature of the company being targeted. A single...
CY-Kit
Chinese backed phishing services
CY-Kit represents a dangerous evolution in phishing, moving beyond simple credential harvesting to a “live puppeteer” model where operators control victim sessions in real time via Socket.IO. This Chinese-backed framework...
Oriental Gudgeon aka. "CoGUI"
Chinese backed phishing services
Oriental Gudgeon, also known as CoGUI, has undergone a major architectural shift toward a centralized encrypted wrapper model to mask its global phishing operations. This latest iteration employs defensive anti-analysis...
Darcula aka. "Magic Cat"
Chinese backed phishing services
The Darcula phishing framework continues to evolve, transitioning from early API-driven roots to a sophisticated “Phishing-as-a-Service” model using encrypted WebSockets and wrapper APIs. Our latest research uncovers the inner workings...
Sailor Framework
Chinese backed phishing services
The Sailor Framework has emerged as a highly specialized Chinese-backed phishing ecosystem, moving away from broad industry attacks to dominate a specific vertical: U.S. state government and tolling infrastructure. By...
Beyond the Lure
Uncovering Distinct Phishing Tooling Behind Calendly-Themed Campaigns
Phishing campaigns that impersonate a single brand are often assumed to come from a single source, but that assumption rarely holds up. Calendly is a widely used scheduling platform for...
Chinese backed phishing services
Summarizing the large scale campaigns backed by Chinese language setups
Over the past several months, the urlscan Threat Research Team has conducted extensive research to identify, cluster, and track some of the most impactful Chinese-language phishing-as-a-service (PhaaS) ecosystems operating at...
Proxying Trust
JavaScript Framework Abuse in Phishing
During routine monitoring of malicious web activity on the urlscan platform, the urlscan Threat Research Team identified a phishing campaign abusing the Ultraviolet (UV) client-side proxy framework. This framework was...
Subscribe via RSS