BlackOctopus PhaaS: From a Phishing Email to Claude Sonnet

It started with a suspicious link landing in analysis. A classic fake OneDrive notification, sender name blurred, document titled “Proposta di Ricerca” (Research Proposal), hosted on a Cloudflare Workers subdomain:

**core-drive-wvzc.p-xmnew9m7.workers[.]dev**.

The lure is well-crafted. It clones the Microsoft OneDrive sharing UI down to the font and spacing, presents a PDF document preview, and displays a device verification code, in this case GHG53NTT2, with four-step instructions telling the victim to copy it and authenticate at microsoft.com/devicelogin.

This is a textbook OAuth Device Code phishing flow. The victim does not land on a fake login page. Instead, they are directed to the legitimate Microsoft authentication portal and enter the attacker-controlled code themselves. Microsoft considers the request valid, issues a token, and the attacker receives full OAuth access to the victim account without ever touching their credentials or triggering MFA.

The page was already intercepted in Burp Suite before any interaction. The C2 polling was visible immediately.

The HTTP History revealed the kit’s communication pattern immediately after the lure page loaded. Three endpoints caught attention.

The loader at

hxxps[://]core-drive-wvzc.p-xmnew9m7.workers[.]dev/l/m6bpWLxZNuQ

renders a spinner for two seconds, then silently fetches the landing page content via JavaScript without triggering a navigation event. A classic anti-analysis technique designed to confuse automated scanners that only check the initial response.

The landing page at

hxxps[://]core-drive-wvzc.p-xmnew9m7.workers[.]dev/lp/m6bpWLxZNuQ

contains the full device code UI. Embedded in the source is a JavaScript polling loop that fires a GET request to

**api.blackoctopusking[.]xyz/api/status/*****

every three seconds, waiting for confirmation that the victim has entered the code at Microsoft’s portal. The session identifier, ****, is sequential and hardcoded per victim session. When Microsoft confirms the code was entered, the C2 responds with {“status”:”captured”} and the page silently redirects to outlook.com to avoid raising suspicion.

The redirector chain was also visible in the history. The initial entry point traced back to

**mazaigroup.co[.]tz**

a compromised Tanzanian business domain running a PHP redirector at /.image/go.php?c=119b6fe2898295de. This pattern, a legitimate domain used as a first hop before reaching the actual kit, is a standard technique to bypass reputation-based URL filters in email security gateways.

With the C2 domain identified, the next step was probing

blackoctopusking[.]xyz

directly without the api. subdomain prefix. A simple curl request to the root returned a React single-page application with the title Panel. No authentication wall, no redirect, just the login bundle served to anyone who asks.

The JavaScript bundle at /assets/index-BBvPp_Zw.js was downloaded and analyzed statically. At 3MB of minified React code, it contains the complete client-side logic of the admin panel. Regex extraction of API route strings revealed over sixty backend endpoints, mapping the full functionality of the platform.

The most significant finding was in the settings component. The source contains an explicit Anthropic API key integration, with a UI label that reads verbatim:

Primary AI for BEC reply drafting. Get key from console.anthropic.com

The call chain for AI-assisted BEC is fully documented in the source:

/dash/highvalue scans all captured mailboxes for financial keywords including wire transfer, invoice, payment confirmation, and crypto-related terms. Matches are surfaced in a dedicated dashboard with category labels and unread counters.

/dash/bec/analyze submits a selected email thread to Claude Sonnet along with contextual metadata extracted from the mailbox.

/dash/bec/regenerate allows the operator to refine the generated reply with natural language instructions, for example making the tone more urgent or referencing a specific deadline.

Operators supply their own sk-ant API key. The platform handles context extraction, prompt construction, and draft delivery. The operator reviews the output and sends it manually from the captured account via /dash/inbox, making the final email indistinguishable from a legitimate reply originating from the victim’s own mailbox.

BlackOctopus is not a phishing kit. It is a commercial PaaS with a paying customer base, a reseller tier, and a documented billing system.

The admin panel exposes a full multi-tenant architecture. The /admin/agents endpoint allows the platform operator to deploy independent sub-panels for resellers, each running on a separate subdomain with its own client base, branding, and Cloudflare Worker infrastructure. Each agent has a configurable cost-per-client slot and a balance tracked against the parent operator. This is a franchise model applied to cybercrime infrastructure.

Client registration is gated behind purchasable slots via /admin/billing/buy-slots, with OxaPay as the payment processor for crypto transactions. Unpaid invoices block new client registrations, enforcing a pay-to-operate model that keeps the operator revenue stream consistent regardless of how many downstream actors are running campaigns.

Beyond token capture, the platform gives operators full post-compromise tooling. Exchange Admin access is available for any captured token with directory roles, allowing password resets, account creation, and inbox rule injection directly from the panel. The email extractor runs deep harvests across inbox, sent items, and organizational directories with no message limit, classifying results by mail provider and verifying live mailboxes via Microsoft’s credential API. Cloudflare Worker rotation is one click, allowing operators to cycle lure URLs in seconds when a domain gets flagged by Safe Browsing without losing active campaigns.

The platform supports fourteen languages in the lure templates, has built-in keyword monitoring with Telegram alerting, and maintains a high-value email scanner that automatically surfaces financial threads across all captured accounts every five minutes.

Indicators of Compromise

• blackoctopusking[.]xyz -> C2 and admin panel
• api.blackoctopusking[.]xyz -> Victim session polling endpoint
• core-drive-wvzc.p-xmnew9m7.workers[.]dev -> Lure hosting via Cloudflare Worker
• **mazaigroup.co[.]tz** -> Compromised redirector (initial entry point)
• 104.21.95.104 -> Panel host (Cloudflare CDN)
• 104.21.76.145 -> Lure host (Cloudflare CDN)
• 203.161.52.142 -> Redirector host

The question is no longer whether threat actors are using AI. BlackOctopus answers it with a settings page and a billing model. Claude Sonnet is not the threat. The threat is a criminal platform that treats it as a feature, ships it to paying customers, and automates the most human-looking part of the attack chain, the reply. The inbox is already compromised. The token is already captured. What AI adds is scale, context, and convincing prose at a price point any operator can afford.

That is the frontier worth watching.