Taking apart a smishing kit that beat SMS 2FA

The challenge

A smishing campaign impersonating a national e-services / fine-payment portal was harvesting payment and identity data. The goal was attribution and takedown evidence — without touching victims or submitting any data.

How it unfolded

1. Collected and hash-sealed infrastructure and the live page kit for chain-of-custody.
2. Reverse-engineered the single-page-app kit and mapped the victim funnel and the full set of harvested fields.
3. Identified real-time exfiltration over a same-origin websocket, with the hosting server itself acting as the operator backend.
4. Assessed capability: live PIN and OTP relay indicated an interactive operator defeating SMS-2FA and 3-D Secure in real time — a high-capability kit, not a static dump.
5. Clustered the infrastructure and attributed it to a phishing-as-a-service operation reused across multiple countries and lures.

Impact

Active, scaled theft of payment cards and identity data from citizens, with two-factor authentication bypassed in real time.

Outcome

Hashed evidence with documented chain of custody and multi-party takedown packages (registrar, hosting, national CERT, browser blocklists, certificate authority) suitable for law-enforcement handover. All analysis was retrieval-only — no data was ever submitted to the attacker's infrastructure.