Incident Investigation Report: GrabThePhisher — Dismantling a DeFi Phishing Kit
Platform: CyberDefenders
Challenge: GrabThePhisher
Category: Threat Intelligence
Difficulty: Easy
Tools: Static Code Analysis, CyberChef
Achievement: Proof of Completion
1. Executive Summary
Incident Type: Credential Harvesting / Phishing
Target: Decentralized Finance (DeFi) — MetaMask / PancakeSwap Users
A decentralized finance (DeFi) platform reported unauthorized fund withdrawals from multiple user wallets. Investigation of the suspected server uncovered a phishing kit — a fully functional PHP backend — impersonating the PancakeSwap exchange. The kit was designed to trick victims into entering their 12-word MetaMask seed phrases, which were simultaneously saved locally on the server and exfiltrated in real-time via the Telegram Bot API. Three wallets had already been compromised before the kit was discovered.
Indicators of Compromise (IOCs)
| Type | Indicator | Description |
|---|---|---|
| Exfiltration Domain | api.telegram.org | Telegram Bot API used for real-time exfiltration |
| Telegram Bot Token | 5457463144:AAG8t4k7e2ew3tTiOIBShcWbSia0Irvxm10 | Attacker’s bot credential |
| Telegram Chat ID | 5442785564 | Attacker’s receiving channel |
| Threat Actor Alias | j1j1b1s@m3r0 | Developer alias found in source code comments |
| Geolocation API | http://api.sypexgeo.net/json/ | Used to profile victim locations |
| Victim Log File | ./log/log.txt | Local credential storage on compromised server |
| Compromised Seed Phrase | father also recycle embody balance concert mechanic believe owner pair muffin hockey | Most recent captured 12-word phrase |
MITRE ATT&CK Mapping Overview
| Tactic | Technique | ID |
|---|---|---|
| Initial Access | Phishing — Spearphishing Link | T1566.002 |
| Execution | Server-Side Scripting (PHP) | T1059.007 |
| Discovery | System Location Discovery via Geo API | T1614 |
| Collection | Adversary-in-the-Middle — Credential Harvesting | T1557 |
| Exfiltration | Exfiltration Over Web Service (Telegram) | T1567 |
2. Background: Anatomy of a Phishing Kit
Before analyzing the artifacts, it is essential to understand what a “phishing kit” actually is and why it matters for threat intelligence. A phishing kit is not just a fake web page — it is a complete, pre-packaged attack platform that commoditizes credential theft.
| Component | Purpose | What It Tells an Investigator |
|---|---|---|
| Frontend (HTML/CSS/JS) | Visual clone of the target site (PancakeSwap, MetaMask, etc.) | Which brand/service is being impersonated |
| Backend (PHP/Python) | Processes submitted credentials, handles exfiltration | The attacker’s infrastructure, exfiltration channels, and tradecraft |
| Geolocation Module | Profiles victim IP addresses | Attacker’s victim-selection criteria and anti-analysis techniques |
| Exfiltration Channel | Sends stolen data to the attacker (Telegram, email, webhook) | Direct access to the attacker’s infrastructure — often reveals identity |
| Local Logging | Saves credentials to a text file on the server | Enables victim impact assessment and credential recovery |
Why understanding kit architecture matters: Phishing kits are often sold or shared on underground forums. The same kit may be deployed by dozens of different operators. By analyzing the backend code — developer comments, hardcoded API tokens, exfiltration channels — we can attribute the kit to a specific developer and identify the specific operator. This is the difference between “someone phished our users” and “the developer j1j1b1s@m3r0 built this kit, and operator X deployed it using Telegram bot 5457463144.”
Why This Matters for DeFi: Cryptocurrency phishing is fundamentally different from traditional credential theft. A stolen bank password can be reset; a stolen seed phrase grants permanent, irrevocable control of all associated funds. There is no “fraud department” to call, no chargeback mechanism, and no way to freeze the attacker’s wallet. Speed of detection directly determines financial loss.
3. Phase 1: Triage & Target Identification (Questions 1 & 2)
Objective: Identify the phishing kit’s primary target and the backend file responsible for processing stolen credentials.
Upon extracting the phishing kit archive (pankewk), the initial review was of the directory structure. Multiple frontend assets themed around PancakeSwap were present. However, one subdirectory stood out immediately:
A dedicated folder named metamask contained a complete PHP processing backend. This naming convention is deliberate — phishing kit developers structure their kits by target wallet, making it trivial to identify the intended victim profile. The presence of a metamask/ directory with its own .php handler tells us the kit was purpose-built for MetaMask seed phrase harvesting, not a generic login phisher.
Why the directory structure matters: Many phishing kits support multiple targets simultaneously (e.g., MetaMask, Trust Wallet, Coinbase). The folder-per-target structure means this kit could be extended trivially by the operator. During investigation, always check for other target directories — their presence would indicate a broader campaign.
Answer Q1
What cryptocurrency wallet is the phishing kit targeting?
MetaMask
Answer Q2
What is the file that is responsible for managing the phishing kit?
metamask.php
4. Phase 2: Backend Code Analysis (Questions 3 & 4)
Objective: Analyze the backend script to understand the processing language and how the kit profiles its victims.
Opening metamask.php revealed a PHP script with two key behaviors: it captures the submitted seed phrase from a form POST, and before exfiltrating it, it makes an external API call to enrich the stolen data with geographic context.
Victim Profiling: The Geolocation Enrichment Step
The script calls http://api.sypexgeo.net/json/ — a third-party geolocation API — using the victim’s IP ($_SERVER['REMOTE_ADDR']). This returns the victim’s country and city, which is appended to the stolen credential record before exfiltration.
Why attackers profile victims geographically: This is not idle curiosity. Geographic profiling serves three purposes:
- Filter out researchers: Security analysts and automated sandboxes often operate from known IP ranges (cloud providers, corporate VPNs). Filtering by geography helps the attacker ignore “junk” submissions.
- Prioritize high-value targets: Victims from wealthier countries or regions with higher crypto adoption may be drained first.
- Evade law enforcement: If the attacker avoids targeting their own country, they reduce the risk of domestic prosecution.
Analyst Note: Geolocation profiling by phishing kits is a growing trend. By filtering out IPs from known security vendor ranges or countries of no interest to the attacker, the kit can maximize the relevance of captured credentials and reduce noise in the exfiltration channel.
Answer Q3
What programming language is used to develop the kit?
PHP
Answer Q4
What service does the kit use to extract the user’s IP address details?
Sypex Geo
5. Phase 3: Victim Data Recovery (Questions 5 & 6)
Objective: Determine how many victims have been compromised and recover the most recently stolen seed phrase.
The code analysis revealed a secondary logging mechanism — a redundant local backup of every stolen credential:
1
@file_put_contents($_SERVER['DOCUMENT_ROOT'].'/log/'.'log.txt', $text, FILE_APPEND);
Understanding the dual-logging strategy: The attacker implemented two independent exfiltration paths — Telegram for real-time delivery and log.txt for local persistence. This is intentional redundancy: if the Telegram bot is revoked, the attacker can still SSH into the server and retrieve credentials from the log file. Conversely, if the server is taken down, they already have all credentials delivered to Telegram.
Why this matters for investigators: The local log.txt file is a goldmine for the defense team. It provides a complete record of every compromised wallet, enabling immediate victim notification. Navigating to ./log/log.txt exposed three entries — three real victims whose 12-word seed phrases were irrecoverably compromised.
Analyst Note: A 12-word seed phrase is the master key to a cryptocurrency wallet. There is no “password reset” or recovery mechanism — possession of the seed phrase means full, permanent ownership of all associated funds. Victims must be notified immediately and must transfer any remaining funds to a new wallet generated on a clean device.
Answer Q5
How many cryptocurrency wallets have been compromised so far?
3
Answer Q6
What is the crypto wallet address of the Phisher? (The most recent captured seed phrase)
father also recycle embody balance concert mechanic believe owner pair muffin hockey
6. Phase 4: Exfiltration Channel & Threat Actor Attribution (Questions 7–10)
Objective: Identify the primary exfiltration mechanism and extract threat actor credentials for attribution.
The script’s sendTel() function is where the real intelligence goldmine is:
The Telegram Exfiltration Pipeline
Every seed phrase submitted by a victim triggers a Telegram API call (https://api.telegram.org/bot<TOKEN>/sendMessage), delivering the stolen data directly to the attacker’s private Telegram channel in real-time.
Why attackers choose Telegram over traditional C2: Telegram offers three critical advantages as an exfiltration channel:
- Traffic legitimacy: HTTPS to
api.telegram.orglooks identical to normal Telegram usage — firewalls and proxies almost never block it. - No infrastructure cost: The attacker doesn’t need to maintain a dedicated C2 server. Telegram’s infrastructure handles message delivery, storage, and availability for free.
- Real-time mobile notifications: The attacker receives a push notification on their phone the instant a victim submits their seed phrase — enabling immediate wallet draining before the victim realizes anything is wrong.
Threat Actor OPSEC Failure
The function contains two hardcoded secrets: the Bot Token (5457463144:AAG8t4k7e2ew3tTiOIBShcWbSia0Irvxm10) and the Chat ID (5442785564). Additionally, source code comments left by the developer contain their alias — j1j1b1s@m3r0.
Why this is a critical OPSEC failure: The Telegram Bot Token is essentially an API key that grants full control over the bot. With this token, a defender can:
- Query the bot’s profile information (potentially revealing the attacker’s Telegram account)
- Read the bot’s message history (recovering all previously exfiltrated credentials)
- Disable the bot entirely (cutting off the exfiltration channel)
Leaving developer aliases in source code comments is the equivalent of signing your crime — it provides a direct pivot for cross-platform OSINT investigation.
Analyst Note: The Telegram Bot API is increasingly abused as a C2 and exfiltration channel because the traffic appears legitimate (HTTPS to api.telegram.org), is encrypted end-to-end, and is rarely blocked by corporate firewalls. Defenders should monitor web server outbound connections to
api.telegram.org— legitimate web servers have no business reason to call this endpoint.
Answer Q7
What cryptocurrency exchange is the kit impersonating?
PancakeSwap
Answer Q8
What is the phishing kit’s Telegram bot token?
5457463144:AAG8t4k7e2ew3tTiOIBShcWbSia0Irvxm10
Answer Q9
What is the phishing kit’s Telegram chat ID?
5442785564
Answer Q10
What is the identifier of the threat actor that created this kit?
j1j1b1s@m3r0
7. Reconstructed Attack Flow
Based on the source code analysis and victim log recovery, we can reconstruct the complete phishing attack lifecycle from victim interaction to fund theft:
| Step | Actor | Action | Evidence Source |
|---|---|---|---|
| 1. Kit Deployment | Attacker (j1j1b1s@m3r0) | Deploys phishing kit to compromised server; frontend mimics PancakeSwap | Directory structure: pankewk/ with PancakeSwap-themed assets |
| 2. Victim Lured | Victim | Clicks phishing link (via email, ad, or SEO poisoning) and lands on fake PancakeSwap page | Frontend HTML/CSS clone |
| 3. Seed Phrase Entered | Victim | Enters 12-word MetaMask seed phrase into the fake “Connect Wallet” form | metamask.php — form POST handler |
| 4. Geolocation Profiling | Server | metamask.php queries api.sypexgeo.net to geolocate the victim’s IP | $_SERVER['REMOTE_ADDR'] → Sypex Geo API call |
| 5. Local Logging | Server | Seed phrase + geo data appended to ./log/log.txt | file_put_contents() with FILE_APPEND |
| 6. Real-Time Exfiltration | Server → Telegram | sendTel() function sends formatted message to attacker’s Telegram channel | Bot Token 5457463144:... → Chat ID 5442785564 |
| 7. Wallet Drain | Attacker | Receives Telegram notification, imports seed phrase into their own wallet, transfers all funds | (Inferred — blockchain transactions) |
Key Observation: Steps 3–6 happen in under one second. From the moment the victim clicks “Submit” to the moment the attacker receives the seed phrase on their phone, there is effectively zero response time for the victim. This is why prevention (phishing awareness, URL validation, hardware wallets) is the only viable defense — detection and response cannot outpace this attack chain.
8. Conclusion
The GrabThePhisher investigation reveals a ready-made, operationally mature phishing kit targeting cryptocurrency users. Key findings:
- Target: MetaMask wallet holders lured via fake PancakeSwap pages.
- Backend: PHP script (
metamask.php) handling form submissions with victim geolocation profiling via Sypex Geo. - Dual Logging: Credentials stored locally in
log.txtAND exfiltrated in real-time via Telegram Bot API. - Scope: Three wallets compromised before detection.
- Attribution: Developer alias
j1j1b1s@m3r0exposed via code comments — a clear OPSEC failure.
Key Takeaways for the SOC:
- Phishing kits leave fingerprints: Developer aliases in source comments, hardcoded API keys, and local log files are intelligence goldmines that must be recovered during investigation.
- Telegram is the new exfiltration drop: Monitor for anomalous outbound connections from web servers to
api.telegram.org. This is never legitimate on a production web server. - File extension ≠ File type:
.jpg.phpand.pdf.exetricks remain effective. Always validate MIME types, not filenames. - Crypto theft is permanent: Unlike bank transfers, cryptocurrency transactions cannot be reversed. Incident response timelines must be treated as critical to minimize further loss.
Analysis Date: April 8, 2026 Analyst: El OMARI Zakaria