Dissecting a BEC Phishing Chain: From Fake Payment Advice to Real-Time Google AiTM Credential Harvester

TL;DR

We received a Business Email Compromise (BEC) phishing email disguised as a payment advice notification forwarded by a compromised corporate account. Our analysis revealed a sophisticated three-stage attack chain:

• Stage 1: A fake Google Drive page hosted on systeme[.]io (a legitimate marketing platform abused as phishing infrastructure)
• Stage 2: A fake CAPTCHA gate on treadrure[.]works with heavily obfuscated JavaScript that builds and auto-submits a hidden POST form
• Stage 3: A pixel-perfect Google Sign-in clone using Socket.IO 4.6.0 for real-time Adversary-in-the-Middle (AiTM) credential relay and CryptoJS 4.2.0 for encrypted exfiltration — handling every Google 2FA method including SMS, TOTP, push, backup codes, and recovery flows

1. The Phishing Email

The attack begins with a forwarded email that landed in a corporate Google Groups mailing list. Here are the sanitized headers:

1
2
3
4
5

From:    [REDACTED] via report.spam <report.spam@[REDACTED].com>
Reply-To: [REDACTED] <[REDACTED]@[REDACTED].com>
To:      report.spam@[REDACTED].com
Subject: Fwd: PYMT-Advice for 02-20-2026
Date:    Fri, 20 Feb 2026 18:53:20 -0600

What Makes This Email Convincing

The email appears to be forwarded by a legitimate employee at a real company (a global business process automation firm). The forwarding account has a proper email signature with:

• Full name and title (“Customer Relationship Manager”)
• Office address (6641 N. Beltline Rd, Suite 100, Dallas TX 75063)
• Phone numbers and corporate branding images
• Links to the real corporate domain

The “FYI….” at the top makes it look like an internal forward of a routine payment notification — a classic BEC social engineering technique.

The Forwarded Message

Inside the forwarded content, the actual phishing payload is minimal:

1
2
3
4
5
6
7
8

From: AP <payables@jumpgrowth[.]us>
Subject: PYMT-Advice for 02-20-2026

Good Afternoon,

Please refer to attached pdf link below

🔗 PaymentAdvice02202026-pdf  →  https://53ab-dm.systeme[.]io/

The link text says “PaymentAdvice02202026-pdf” but actually points to systeme.io — not a PDF at all. A “disclaimer” block at the bottom references ventia.com, an Australian infrastructure company completely unrelated to the sender — a copy-paste artifact from a different phishing template or compromised mailbox.

Email Authentication Analysis

Here is what makes this email particularly dangerous — it passes all standard email authentication checks:

1
2
3
4

dkim=pass  header.i=@[REDACTED].com
spf=pass   (domain of charnita.pradia@[REDACTED].com designates 209.85.220.41)
dmarc=pass (p=REJECT sp=REJECT)
arc=pass   (i=3)

The forwarding employee’s Google Workspace account appears to be genuinely compromised — this is not a spoofed email. The original “payment advice” from payables@jumpgrowth[.]us was forwarded through a real, authenticated corporate mailbox.

Sender Domain: jumpgrowth.us

1
2
3
4

Registrar:     GoDaddy.com, LLC
Creation Date: 2023-12-21
Registrant:    OTS Solutions
Address:       450 Century Parkway, Ste 250, Allen TX 75013

The domain jumpgrowth[.]us is registered to a legitimate IT staffing/consulting company. It is likely that this domain was also compromised and used to send the initial “AP” (Accounts Payable) payment advice emails.

2. Stage 1: Fake Google Drive (systeme.io)

Clicking the link takes the victim to https://53ab-dm.systeme[.]io/ — a page hosted on systeme.io, a legitimate SaaS marketing/funnel-building platform.

The phishing page impersonates Google Drive with the Google “G” logo, Drive icon surrounded by document-type icons (Word, PDF, Excel, Images), and a prominent “VIEW OR DOWNLOAD DOCUMENT” button. The footer reads “Google Drive ©2026 Google” with fake Privacy Policy and Terms links.

Why systeme.io?

Attackers abuse legitimate marketing platforms because:

1. Domain reputation: systeme.io has high trust scores — email filters and web proxies rarely block it
2. Free tier: The platform allows creating landing pages for free, no identity verification required
3. SSL by default: Amazon CloudFront provides HTTPS, lending visual credibility
4. Easy setup: Drag-and-drop page builders make it trivial to clone Google Drive’s appearance

Page Structure

Every link on the page — the “Secured Google Drive” header, the “VIEW OR DOWNLOAD DOCUMENT” button, “Privacy Policy”, and “Terms of Service” — all point to the same URL:

1

https://put.treadrure[.]works/rInJJaP!G6vsvdamVzI/

The subdomain 53ab-dm on systeme.io is a unique identifier for this campaign — likely one of many rotating subdomains the attacker creates and discards.

3. Stage 2: Fake CAPTCHA Gate (treadrure.works)

The second stage presents a convincing “Human Checkpoint” CAPTCHA page:

1
2
3
4
5
6
7

Human Checkpoint
Type the characters shown to continue.
[Canvas-rendered CAPTCHA image]
Case-insensitive
[Enter code...]  [Clear]  [Verify]
Active session
Status: active

Obfuscated Form Builder

The page includes a self-executing JavaScript function that constructs a hidden HTML form using string manipulation to evade static analysis:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

// Deobfuscated:
const formTag  = "---mrof---".slice(3, 7).split("").reverse().join("");
// → "form"

const inputTag = "t-u-p-n-i".split("-").reverse().join("");
// → "input"

const hidden   = "999neddih111".substring(3, 9).split("").reverse().join("");
// → "hidden"

const method   = [..."X P O S T Y"]
  .filter(c => c !== " " && !"XY".includes(c)).join("");
// → "POST"

This creates a hidden <form method="POST"> with a hidden input named zone. The form is injected into the DOM at runtime, invisible to static page scrapers.

Canvas-Rendered CAPTCHA

The CAPTCHA is rendered client-side on an HTML <canvas> element using randomized fonts, rotation, wave distortion, and noise dots. This is not a real bot-detection service — it is purely an anti-analysis gate to prevent automated security scanners from reaching the credential harvesting page.

Auto-Submit on Verification

When the user enters the correct code, the verification handler calls:

1
2
3
4
5

document.getElementById('CUMSLQGgHx')[
  ['summary','user','box','media','index','task']
    .map(w => w[0]).join('')
]();
// Maps to: .submit()

The first letter of each word — s, u, b, m, i, t — spells submit. This obfuscated form.submit() call POSTs to the server, which redirects to the final credential harvesting stage.

4. Stage 3: AiTM Google Sign-In Clone

After the CAPTCHA, the victim lands on a pixel-perfect replica of the Google Sign-in page:

The credential harvesting page shows “Sign in to continue to Gmail” with the standard Google layout — email input, “Forgot email?” link, Guest mode suggestion, “Create account” and “Next” buttons. The URL bar reveals put.treadrure[.]works instead of accounts.google.com.

Comprehensive 2FA Interception

This is not a simple login page clone. The DOM contains pre-built screens for every possible Google authentication flow:

The masked phone numbers ((•••) •••-••29, (•••) •••-••12) show that the kit dynamically fetches the victim’s real partial phone number from Google — confirming this is a real-time proxy, not a static clone.

Real-Time AiTM Architecture

The network traffic reveals the libraries powering the real-time credential relay:

The Adversary-in-the-Middle flow works like this:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

Victim's Browser                Attacker's Server              Google's Real Login
       │                               │                              │
       │──── Email ────────────────────►│──── Email ──────────────────►│
       │                               │                              │
       │◄──── Show Password Screen ────│◄──── Password Required ─────│
       │                               │                              │
       │──── Password ────────────────►│──── Password ───────────────►│
       │                               │                              │
       │◄──── Show 2FA Screen ────────│◄──── 2FA Required ──────────│
       │      (correct method)         │      (SMS/TOTP/Push/etc)     │
       │                               │                              │
       │──── 2FA Code ────────────────►│──── 2FA Code ──────────────►│
       │                               │                              │
       │                               │◄──── Session Token ─────────│
       │                               │      (ATTACKER CAPTURES)     │
       │◄──── "Login Failed" ─────────│                              │
       │      or redirect              │                              │

The attacker proxies each step in real-time via Socket.IO, presenting the correct 2FA challenge to the victim based on what Google actually requires for that account. Once Google issues a session token, the attacker captures it — game over.

Self-Hosted Google Fonts

The phishing kit serves Google’s proprietary fonts locally to avoid external requests that might tip off network monitoring:

1
2
3
4
5
6
7

GDSherpa-bold.woff2        (Google Design font)
GDSherpa-regular.woff2
GDSherpa-vf.woff2
GoogleSans-Regular.woff2
GoogleSans-Medium.woff2
Roboto-Regular.woff2
Roboto-Medium.woff2

Locale Leak

The Terms of Service link points to:

1

https://accounts.google.com/TOS?loc=PK&hl=en-US

The loc=PK parameter (Pakistan) is a configuration artifact revealing the phishing kit developer’s likely locale or testing origin.

5. Infrastructure Analysis

Domain: treadrure.works

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

Domain:      treadrure[.]works
TLD:         .works (Binky Moon / Identity Digital)
Nameservers: eoin.ns.cloudflare.com, linda.ns.cloudflare.com
A Records:   104.21.74.207, 172.67.162.229 (Cloudflare)
AAAA:        2606:4700:3035::6815:4acf, 2606:4700:3033::ac43:a2e5
SPF:         v=spf1 -all  (hard fail — no legitimate email)
SSL Cert:    CN=treadrure.works
  Issuer:    Google Trust Services WE1
  Valid:     2026-01-31 to 2026-05-01
  SAN:       treadrure.works, *.treadrure.works (wildcard)

The domain name treadrure is a deliberate typosquat of “treasure” — close enough to pass a quick glance but different enough to be available for registration. The wildcard SSL certificate allows the attacker to spin up unlimited subdomains (put.treadrure.works, get.treadrure.works, etc.) without issuing new certificates.

Domain: gefai.best (Secondary Infrastructure)

1
2
3
4
5
6

Domain:      gefai[.]best
Nameservers: brianna.ns.cloudflare.com, christian.ns.cloudflare.com
A Records:   104.21.2.115, 172.67.129.33 (Cloudflare)
SSL Cert:    CN=gefai.best
  Issuer:    Google Trust Services WE1
  Valid:     2026-02-11 to 2026-05-12

The subdomain rainy.gefai[.]best serves a JavaScript resource (autogen.sfbnmak) loaded by the phishing page — likely analytics, fingerprinting, or additional obfuscation code.

Platform Abuse: systeme.io

1
2
3
4
5

Platform:    systeme.io (SaaS marketing funnel builder)
Hosting:     Amazon CloudFront (3.162.38.x range)
DNS:         AWS Route53 (ns-109.awsdns-13.com, etc.)
SSL:         Amazon RSA 2048 M04
Subdomain:   53ab-dm (campaign-specific)

Systeme.io is a legitimate French SaaS platform for building landing pages, email funnels, and online courses. The attacker abuses the free tier to host convincing phishing landing pages that inherit the platform’s trusted domain reputation.

6. Attack Flow Summary

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

┌─────────────────────────────────────────────────────────────┐
│  1. COMPROMISED CORPORATE EMAIL                             │
│     Employee at [REDACTED].com (legit company)             │
│     Forwards "payment advice" to internal mailing list      │
│     DKIM ✓  SPF ✓  DMARC ✓  ARC ✓                         │
└──────────────────────┬──────────────────────────────────────┘
                       │
                       ▼
┌─────────────────────────────────────────────────────────────┐
│  2. FAKE PAYMENT LINK                                       │
│     "From: AP <payables@jumpgrowth[.]us>"                   │
│     Link disguised as: PaymentAdvice02202026-pdf            │
│     Actual URL: https://53ab-dm.systeme[.]io/               │
└──────────────────────┬──────────────────────────────────────┘
                       │
                       ▼
┌─────────────────────────────────────────────────────────────┐
│  3. STAGE 1: FAKE GOOGLE DRIVE (systeme.io)                 │
│     Google Drive logo + "Click Below To View Documents"     │
│     [VIEW OR DOWNLOAD DOCUMENT] button                      │
│     All links → put.treadrure[.]works                       │
└──────────────────────┬──────────────────────────────────────┘
                       │
                       ▼
┌─────────────────────────────────────────────────────────────┐
│  4. STAGE 2: FAKE CAPTCHA GATE (treadrure.works)            │
│     Canvas-rendered CAPTCHA (anti-scanner)                   │
│     Obfuscated JS builds hidden POST form                   │
│     Auto-submits on correct code                            │
└──────────────────────┬──────────────────────────────────────┘
                       │
                       ▼
┌─────────────────────────────────────────────────────────────┐
│  5. STAGE 3: AiTM GOOGLE SIGN-IN (treadrure.works)          │
│     Pixel-perfect Google login clone                        │
│     Socket.IO real-time credential relay                    │
│     CryptoJS encrypted exfiltration                         │
│     Handles ALL 2FA methods (SMS, TOTP, push, backup, etc) │
│     Captures session tokens → full account takeover         │
└─────────────────────────────────────────────────────────────┘

7. Indicators of Compromise

Network IOCs

URLs

SSL Certificates

Phishing Kit Fingerprints

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# JavaScript libraries loaded by the credential harvester
Socket.IO 4.6.0       (cdn.socket.io)
CryptoJS 4.2.0        (cdnjs.cloudflare.com)
jQuery 3.6.0           (cdn.jsdelivr.net)
list.js 2.3.1          (cdnjs.cloudflare.com)

# Self-hosted Google fonts (served from put.treadrure.works)
GDSherpa-bold.woff2
GDSherpa-regular.woff2
GoogleSans-Regular.woff2
GoogleSans-Medium.woff2
Roboto-Regular.woff2
Roboto-Medium.woff2

# Locale artifact in TOS link
accounts.google.com/TOS?loc=PK

MITRE ATT&CK

AlienVault OTX Pulse

IOCs from this analysis have been published to AlienVault OTX:

BEC Phishing: Fake Payment Advice to AiTM Google Credential Harvester

8. Detection and Recommendations

For Security Teams

• Block treadrure[.]works and gefai[.]best at the DNS/proxy level
• Alert on Socket.IO WebSocket connections to non-corporate domains — legitimate Google login never uses Socket.IO
• Flag emails containing links to systeme.io subdomains, especially in finance/payment contexts
• Monitor for Google Workspace accounts sending unusual forwards to mailing lists
• Report the systeme.io page at 53ab-dm.systeme.io to systeme.io abuse team

For End Users

• Check the URL bar before entering Google credentials — accounts.google.com is the only legitimate domain
• Be suspicious of “payment advice” emails that link to document-sharing services instead of attaching actual files
• Use hardware security keys (FIDO2/WebAuthn) — they are the only 2FA method that AiTM phishing kits cannot intercept, because the key cryptographically binds to the real domain
• Report suspicious forwarded emails to your IT security team, even if they come from known colleagues

Why Hardware Security Keys Matter

AiTM phishing kits like this one can intercept SMS codes, TOTP codes, push notifications, backup codes, and recovery email verifications. The only 2FA method they cannot defeat is FIDO2/WebAuthn hardware security keys (like YubiKeys or Titan Security Keys), because the cryptographic challenge-response is bound to the real domain (google.com) and will not respond to a phishing domain (treadrure.works).

Analysis performed on 2026-02-24. Email headers sanitized to protect the compromised individual’s identity. IOCs published to AlienVault OTX.