Credential-Harvesting

Fake Stewart Title closing document portal hosted on lovable.app with progress bar and Open Document button

Dissecting a Real Estate BEC Phishing Chain: From Fake Stewart Title Closing Docs to Multi-Layer Encrypted AiTM Router

A BEC phishing email impersonating a Stewart Title escrow officer sends fake closing documents via a compromised law firm. Five-stage chain abusing Lovable (AI app builder), a CAPTCHA gate, triple-encrypted JavaScript with anti-debug traps and a remote kill switch, a server-side AiTM credential router, and a pixel-perfect Google Sign-In proxy capturing credentials and session tokens in real-time.

Fake Google Drive phishing page hosted on systeme.io impersonating a Secured Google Drive document sharing interface

Dissecting a BEC Phishing Chain: From Fake Payment Advice to Real-Time Google AiTM Credential Harvester

A real-world BEC phishing email impersonating a payment advice notification. Three-stage attack chain abusing systeme.io, a fake CAPTCHA gate, and a real-time Adversary-in-the-Middle Google credential harvester with full 2FA interception.