Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts. Method and limits
A May phishing advertisement promised to bypass every form of two-factor authentication. Its own description then said the system would wait for the user’s approval or SMS. The broad claim and the stated dependency appear in the same post. Reading them together reveals the role the advertisement still assigns to the person signing in.
That distinction runs through our comparison of selected phishing offers. Some advertise bank-page templates and collected logs. Others promise session data, device-code access or recovery-phrase pages.
A single product can combine several of these methods. The word “phishing” conceals important differences in what the person is asked to surrender and what access the seller promises afterward.
Brandefense compared eight full saved posts from its local Blackhole collection. These are advertisements and product descriptions, not tested tools or confirmed attacks. Our phishing methods evidence comparison preserves their dates, claims and limits without publishing operating instructions.
The Bypass Claim Still Depends on the User
The 16 May offer, FR-O004, describes a browser-based package. Alongside its sweeping claim about two-factor checks, it says the user completes a login and the system waits for approval or an SMS. The record does not show a security control being broken. It describes a claimed process that still relies on a person’s response.
This matters because “bypass” can hide different propositions. Defeating a protection without the person taking part is not the same claim as inducing that person to complete an authentication step. The May text itself supports the second interpretation of its advertised process. It supplies no test evidence for its universal claim.
A shorter October listing, FR-O006, offers kits for two named services and simply claims they bypass two-factor authentication. It does not explain the same dependency. We cannot use May’s detailed description to fill October’s missing mechanism. Similar sales language does not establish that two products work in the same way.
For a security review, the difference changes the question to investigate: what did the person approve, and what access was then available? A report that records only “MFA bypass” leaves that relationship unexplained. These advertisements justify separating the claims; they do not establish the outcome of an incident.
The Promised Prize Changes Across Offers
A 5 February advertisement, FR-O001, names bank templates and automatic log collection. It supports a finding about the financial services being imitated and the collection claim. It does not specify every field in those logs. We therefore do not relabel them as verified card numbers, passwords or sessions.
A 19 March offer, FR-O009, expressly markets credit-card phishing design and hosting. The same post also advertises crypto-drainer design. Those are distinct advertised objectives inside one menu: obtaining card information and taking funds from a crypto wallet. The post provides no evidence that either occurred.
An August advertisement, FR-O005, names cookies and SMS codes in a real-time phishing claim. In that offer, the advertised object goes beyond a static page or a password alone. Cookies can carry session information; the seller is marketing access related to a sign-in process. We did not test whether the advertised data would grant access.
These distinctions connect phishing to the wider Fraud research. A card-harvesting claim belongs beside the analysis of advertised card material. A session-access claim belongs beside account compromise. Grouping both under a tool label can obscure which asset an investigation needs to account for.
| Selected offer | What it advertises | What remains unproven |
|---|---|---|
| Bank templates / FR-O001 | Bank imitation and log collection. | The contents of the logs and any resulting access. |
| Card phishing / FR-O009 | Card-information collection through a designed and hosted kit. | Collected cards, successful payments or loss. |
| Real-time claim / FR-O005 | Cookies and SMS-code interception. | Working access or defeat of an authentication control. |
| Hosted dashboard / FR-O007 | Credentials, session-related material and a separate device-code feature. | Effective capture, access duration or successful misuse. |
One Dashboard Advertises Several Paths to Access
The 21 October dashboard advertisement, FR-O007, is especially revealing because it names several methods in one offer. It advertises credentials and session-related material alongside device-code login and static recovery-phrase templates for crypto wallets.
Those items do not describe a single stolen object. Credentials concern sign-in secrets. Session material concerns an authenticated state.
A recovery phrase concerns wallet recovery. The device-code feature makes yet another claim about an authorization interaction. We compare these as advertised paths to access, without accepting that any feature worked.
The same record also weakens its own simple contrast between browser-based products and static pages. Although the seller criticizes static templates, it still offers them for recovery phrases. The relevant distinction is therefore the task each page is meant to perform. A static prompt and a browser-based interaction can coexist in the advertised catalogue.
This is why counting kit names would miss part of the method picture. One advertised service contains several access propositions. Conversely, the short October two-service listing gives too little detail to assign it all these capabilities. The comparison supports a map of explicit claims, not an estimate of how common each method is.
The Message Channel Does Not Identify the Method
A June device-themed panel, FR-O010, lists SMS, calls and WhatsApp alongside scripts associated with several phone ecosystems. The October dashboard lists an SMS sender. A January browser-platform description, FR-O012, lists bulk email. These records place different delivery channels around their advertised phishing services.
Delivery and capture need separate labels. An SMS feature tells us something about how a message could reach a person. It does not, by itself, tell us whether the linked interaction seeks card information, a password or session access. A call-related feature also does not establish a complete voice-phishing operation.
The imitation target is a third dimension. The selected posts name banking, email, shopping, social media, device accounts and crypto services. Those are advertised targets or template categories. They are not a list of confirmed victims, and they do not show which sector suffered the most attacks.
Our comparison of phishing service terms asks who supplies the infrastructure and support. This investigation asks what that infrastructure claims to make the person disclose or authorize. The two questions meet at the same product, but they answer different parts of the risk.
Preserve the Access Question in the Investigation
The strongest finding is the mismatch between a simple label and a more complex advertised interaction. “Two-factor bypass” can conceal reliance on the user’s approval. “Phishing kit” can cover card collection, session claims and wallet-recovery prompts. “SMS” can describe delivery without identifying the access sought.
For an incident review, preserve those dimensions separately: the message channel, the service being imitated, the information or approval requested, and the access actually observed. This keeps a claimed session exposure from disappearing into a password-only account of the event. It also prevents a card-themed advertisement from becoming evidence of stolen cards.
The archive cannot establish a successful attack chain from these posts. Its contribution is more specific: the sellers’ own descriptions reveal different dependencies and access goals that broad fraud categories merge. Investigation and response decisions should follow the verified exposure in the case, rather than inherit the advertiser’s headline claim.
The eight records were selected for contrasting methods from an existing evidence catalogue. The collection covers 1 January to 27 October 2026 and is dominated by Telegram, with limited forum coverage. The research methodology explains selection and coverage. No tools, services, logins or payment flows were tested.
