Threat Research

Hook, line, and vault: A technical deep dive into the 1Phish kit | Datadog Security Labs

DataDogHQ
Hook, line, and vault: A technical deep dive into the 1Phish kit | Datadog Security Labs

The 1Phish phishing kit evolved from a simple credential harvester in September 2025 into a multi-stage, MFA-aware, REST-API-driven phishing application by February 2026 that captures emails, secret keys, passwords, OTPs, and recovery codes while employing browser fingerprinting, bot scoring, and JavaScript obfuscation. #1Phish #1Password

Keypoints

  • 1Phish progressed across four distinct versions (V1–V4) from lightweight HTML credential pages to a structured, API-backed phishing kit with session management and internationalization.
  • By V3 the kit added MFA/OTP capture and extensive browser/device fingerprinting to gate victims and enable real-time authentication attempts; V4 introduced REST APIs, recovery-code capture (1PRK format), enterprise/team targeting, and JavaScript obfuscation.
  • The kit implements anti-analysis controls and bot detection (including HideClick integration and automation-property enumeration) to serve benign content to investigators and deliver phishing content to validated victims.
  • Technical linkage across versions—identical frontend build artifacts, hashed SVG filenames, Knox UI class tokens, shared staged endpoints (/step1, /login, /submit-2fa)—indicates a common kit lineage rather than isolated pages.
  • Multiple typosquatted domains were used (11 observed), most fronted by Cloudflare and registered over a narrow window, demonstrating repeatable deployment and active maintenance.
  • No direct evidence of reverse-proxy session-hijacking infrastructure was observed, but explicit collection of OTPs and recovery codes is consistent with intent for real-time authentication abuse or session replay.
  • 1Password and monitoring vendors are tracking and takedown efforts are ongoing; organizations are advised to monitor anomalous logins (especially from Cloudflare) and follow 1Password guidance to avoid entering credentials on lookalike domains.

MITRE Techniques

  • [T1566 ] Phishing – Used email lures and typosquatted domains to direct victims to fake 1Password pages (‘breach-themed email lures claiming that the recipient’s account had been compromised’ / ‘directing victims to typosquatted domains impersonating legitimate 1Password login pages’).
  • [T1056 ] Input Capture – Captured credentials and authentication codes via staged web forms and API endpoints (‘collection of email, secret key, password’ and ‘Submissions trigger a POST to /submit-2fa, including: Email 6-digit OTP code’).
  • [T1027 ] Obfuscated Files or Information – Employed JavaScript obfuscation and encoded detection scripts to hinder analysis (‘there were three obfuscated JavaScript files’ and ‘There is an obfuscated detection script at the bottom of the page. The decoded base64 string contains a list of properties usually associated with automation tools’).
  • [T1555 ] Credentials from Password Stores – Targeted high-value recovery codes and account-specific secrets (1Password recovery codes) to regain account access (‘The recovery form accepts codes prefixed with 1PRK, which is the format of 1Password’s account recovery codes’).
  • [T1497 ] Virtualization/Sandbox Evasion and Anti-Analysis – Implemented browser fingerprinting, bot scoring, HideClick cloaking, and automation property checks to evade automated analysis (‘anti-automation and browser fingerprinting logic’ and ‘HideClick … serve a harmless “white page” to investigators while delivering the actual content to verified victims’).

Indicators of Compromise

  • [Domain ] Typosquatted 1Password lookalikes – login-1password[.]com, signin-1psswoord[.]com, and 9 more domains (total 11 observed including lon-pass-word[.]com, onepass-word[.]com, 1passwod[.]net, on-pssword[.]com, etc.).
  • [API / Endpoint ] Phishing backend paths and REST API endpoints used for staged capture – /step1, /login, /submit-2fa, and API endpoints such as POST /api/session/{id}/otp, POST /api/fingerprint, POST /api/validate-access.
  • [Cookie ] Validation and cloaking cookies – hideclick:ignore (HideClick evidence) and validated_user_1pass (set after validation), used to gate content or mark validated sessions.
  • [JavaScript files ] Client artifacts indicating kit version/behavior – app.js, sessions-client.js, i18n.js (obfuscated in V4; drive fingerprinting, session management, and i18n support).
  • [Recovery-code format ] High-value credential pattern – 1PRK-prefixed recovery codes accepted by the recovery form (1Password recovery-code format).
  • [Build artifacts / UI tokens ] Shared frontend identifiers linking samples – hashed SVG asset filenames and Knox design system class tokens (examples: knox-reset, reset_base__1e6d9s10), indicating common scraped source artifacts.

Read more: https://securitylabs.datadoghq.com/articles/hook-line-vault-a-deep-dive-into-1phish/

SHARE THIS STORY

WhatsAppX (Twitter)TelegramBlueskyFacebookLinkedInThreadsEmailPrint