Blacksite: New AiTM Phishing Kit Evades URL Scanners via Cloaked.gg

Blacksite is a newly identified adversary-in-the-middle phishing-as-a-service offering sold alongside Cloaked.gg, a cloaking platform that conceals phishing infrastructure from automated security analysis. The kit operates as a reverse-proxy that intercepts authentication tokens, session cookies, and 2FA codes in real time, enabling full account takeover even against MFA-protected accounts. Cloaked.gg blocks traffic from AWS, Google Cloud, and Azure networks while serving AI-generated decoy pages to suspected scanners, making malicious URLs appear benign during automated analysis. Priced between $600-$1,000 monthly, the service commercializes sophisticated AiTM techniques, lowering technical barriers for attackers. The pairing of credential theft capabilities with anti-detection infrastructure creates a split-view environment where security tools see harmless content while intended victims are routed to live phishing pages targeting consumer, financial, and enterprise identity systems.

• Bluekit Phishing as a Service (PhaaS)Phishing2026-06-16
• ScreenConnect Attack: SCKit Turns Remote Support Into an Attack PlatformExploitedMalware2026-11-12
• Shai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI ToolsMalware2026-11-09
• Synacor Zimbra Collaboration Suite (ZCS) · Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570ExploitedVulnerability2026-09-30
• Lunex Unmasked: A New Information Stealer Deployed Through BYOVDMalware2026-09-26