Torzon Phishing Incident Breakdown — Anatomy of a Recent Clone Campaign

Earlier this year, we published a hands-on guide to spotting fake TorZon clones, focusing on the visual tells and URL discrepancies that separate the real market from the impostors. Six months later, the threat landscape has shifted. The era of the cheap, sloppy clone is fading, replaced by a wave of professionally engineered adversary-in-the-middle (AiTM) toolkits that borrow directly from enterprise phishing-as-a-service (PhaaS) playbooks. The recent TorZon phishing incidents are not a return to the static HTML rips of 2024; they are a sophisticated adaptation of tactics observed against Microsoft 365 and Okta environments, now weaponized against darknet market users. This breakdown is a technical post-mortem for researchers and privacy-conscious users, dissecting the anatomy of these campaigns without pointing fingers at any single operator or providing a roadmap to live illicit services.

The Evolution from Static Clones to AiTM Relays

For years, the standard TorZon phishing kit involved a simple HTML copy of the login page. The user would enter their credentials, the data would be POSTed to a server-side script, and the attacker would attempt to log in later. This approach had a fatal flaw: the attacker never possessed the session cookie. In the time it took to manually authenticate, the user’s session on the real market would expire, or the login would trigger a security alert due to the IP mismatch. This left victims with a “Login Failed” error and a suspicion that something was wrong.

The current wave of TorZon clones has abandoned this model in favor of a real-time relay architecture. It is a direct port of the “Sneaky 2FA” and “Kratos” methodologies documented in enterprise threat intelligence reports.

The attack chain on a high-tier phishing kit operates in distinct stages, each designed to defeat a specific layer of user paranoia and automated scanning.

Stage 1: The Human Verification Gate

The most visible change in recent TorZon phishing links is the presence of a Cloudflare Turnstile or reCAPTCHA challenge immediately preceding the login page. At first glance, this seems counterintuitive-why would a phishing site want to add friction? The answer lies in evasion. These challenge gates are designed to block automated scanners and sandboxes from ever reaching the phishing content, since bots typically fail or skip the CAPTCHA [1]. When a security researcher submits a suspicious URL to a crawler, the crawler hits the Turnstile and is stopped. The domain appears clean because the malicious payload is never fetched.

The cybercriminal infrastructure observed in July 2026 takes this a step further, often disguising the gate as a benign “Gourmet Delights” food page or a similar innocuous landing page before redirecting to the auth flow [2]. This is transparent to a human user who clicks through quickly, but it destroys the forensic integrity of the link for automated analysis.

Stage 2: IP-Based Triaging

Once past the CAPTCHA, the traffic is subjected to IP-based filtering. The phishing server silently redirects data-center, VPN, proxy, or known-abuse IPs to a benign page-often a Microsoft-related Wikipedia page via href.li [1]. This is a critical countermeasure against the TorZon community itself. Security researchers, law enforcement, and competing market admins often access phishing sites through VPNs or Tor exit nodes. By filtering these IPs, the attacker ensures that only “genuine” victims-those connecting from residential IPs or presumably compromised home connections-see the fake login.

This creates a peculiar paradox for the darknet user: if you are practicing good OPSEC by using a VPN, you are less likely to see the phishing page at all. You will simply see a redirect to a legitimate encyclopedia page. This often leads users to dismiss the link as “dead” when, in reality, the attacker is simply not interested in harvesting credentials from an IP range that signals a security-conscious user. The target is the casual user logging in from a clean connection.

Stage 3: Autograb and the Fake Login UI

For the victim who passes these filters, the server autofills the user’s email or username from the URL parameter-a technique known as “autograb” [1]. This is a psychological trick. When a login page presents your correct username or email address before you type it, it implies a pre-existing relationship and reduces suspicion. The form itself is pixel-accurate, often using blurred screenshots of real interfaces to mimic the original TorZon dashboard aesthetic [2].

Unlike the Microsoft-targeting kits that clone Outlook and OneDrive, the TorZon clones replicate the market’s distinctive login widget, including the PGP challenge field where users are expected to decrypt a message. This is where the relay architecture becomes vicious.

Credential Relaying and Session Theft

The core of the modern TorZon phishing kit is not the capture of the password-it is the interception of the session cookie. The relay is a two-way proxy. When the victim submits their credentials, the phishing server does not store them to a flat file and log off. Instead, it POSTs those credentials to /validate and relays them live to a server-side script that attempts authentication against the actual TorZon backend [3].

If the market is protected by Two-Factor Authentication (2FA) or PGP-based login verification, the attacker’s relay tool handles this seamlessly. The victim sees the expected “Enter the decrypted message” prompt. When the user decrypts the challenge and submits the response, the response is relayed, and the resulting session cookie is captured server-side. The attacker now has a valid session in real-time. They do not need the password; they have the authenticated cookie. This entire process happens in seconds, leaving the victim with a successful login and no indication that their account is now compromised.

This method renders traditional PGP-based security measures partially ineffective. The user has done everything right-they verified the PGP key matches the one on the “official” Dread forum-but they are interacting with a malicious relay that is passing their legitimate PGP response to the real server while simultaneously copying the cookie.

The “Impossible Device Shift” Detection

For forensic analysts monitoring these attacks, the relay architecture creates a detectable anomaly called an “Impossible Device Shift.” Because the attacker often uses different browsers or automation tools to handle the login step versus the MFA resolution step, the server sees a Safari-on-iOS User-Agent for the login attempt and a Chrome-on-Windows User-Agent for the MFA confirmation [1]. A real user cannot change their browser’s user-agent mid-session between two steps of an authentication flow. While this is a viable detection method for corporate SOCs monitoring Entra ID audit logs, it offers no protection to the individual darknet market user who has no visibility into the server-side logs of the market they are using [3].

The Broader Threat Landscape: PhaaS and Phantom Squatting

These sophisticated relay kits are not being built in isolation. They are part of a larger ecosystem of Phishing-as-a-Service (PhaaS) platforms. The threat intelligence community has tracked platforms like Kratos and Sneaky 2FA across corporate environments. Data from ANY.RUN indicates that throughout July 2026, attackers across the United States, Europe, and Brazil systematically exploited routine corporate workflows to bypass perimeter security controls [4]. The same infrastructure used to compromise Microsoft 365 users is being modified for use against cryptocurrency exchanges and darknet markets.

The recent trend of ‘phantom squatting’ further complicates the research landscape. Unit 42 research confirmed that 13,229 hallucinated domains currently host malicious content, with 16.2% conducting phishing [8]. While most of these target postal services and banking, the tactic of registering domains that do not exist in reality-often generated by AI models-is being adopted by market scammers to create URLs that look legitimate on forum aggregators. These sites leverage SEO poisoning and hidden HTML structures (like JSON-LD) to appear authoritative to the search engines and AI agents that scrape forum content [5]. This makes it increasingly difficult for users to rely on search results to find the “real” market address.

The Meta-Phishing of the “Final Lien Waiver”

We are also seeing a convergence of phishing techniques. Attackers are no longer sending bare .onion links in DMs. They are embedding links and QR codes in seemingly innocuous documents, mirroring the “Final Lien Waiver.pdf” delivery mechanism observed in enterprise attacks [1]. A user downloading a “menu” or “product list” from a vendor forum may find themselves guided through an open-redirect step before landing on a Cloudflare-gated clone. This multi-stage approach is designed to defeat the URL scanners built into Tor Browser and forum spam filters.

Practical Implications for the TorZon User

Given this threat model, the traditional advice of “check the URL twice” is no longer sufficient. The authentication flow itself is the attack surface. For researchers and users operating in this space, the following technical precautions are the minimum baseline:

• Treat all login pages as hostile. Expect that any page asking for credentials may be a relay. If possible, use a dedicated, burn-after-reading session where the loss of the account is an acceptable risk.
• Monitor for “Impossible Device Shifts.” While you cannot see the server logs, you can check your own browser’s user-agent at each step via the Tor Browser console. If the market’s response page behaves oddly or takes an unusually long time between the password step and the PGP step, abort the session immediately.
• Assume the session cookie is the target. If you successfully log in but notice unusual latency or a “session already exists” error on your next login, assume your cookie was cloned. Immediately change your PGP key and escrow passwords, as the attacker may be monitoring the account in real-time.
• Beware of social engineering via documents. Do not open PDFs or images that require you to “login” to view the content, regardless of the source. The “Final Lien Waiver” tactic is designed specifically to bypass the suspicion of a direct link.

The days of the amateur clone are ending. The recent TorZon phishing incidents are a clear indicator that darknet market credential theft has industrialized, adopting the real-time relay and AiTM techniques that were once the exclusive domain of state-sponsored espionage and elite cybercrime groups. The only defense is a paranoid, technical skepticism that assumes the authentication endpoint is always lying.