InfoSecBulletin Cybersecurity for mankind
A new phishing kit called “Spiderman” poses a serious threat to European bank customers, allowing cybercriminals to easily generate realistic fake login pages for multiple banks.
The Spiderman phishing kit is notable for its all-in-one design, combining login templates for various European banks and cryptocurrency platforms into a single, easy-to-use interface.
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
Spiderman offers attackers pre-made clones of major banks in five countries, such as Deutsche Bank, Commerzbank, ING, and CaixaBank, unlike traditional phishing kits that target specific institutions.
Security researchers found around 750 members in a Signal messenger group linked to the toolkit’s seller, showing its widespread use in the cybercriminal community.
Spiderman’s danger lies in its automation. Attackers don’t need web development skills or technical know-how to execute advanced phishing schemes.
The kit simplifies the process for criminals to choose a bank, create an exact copy of its login page, and launch phishing attacks quickly. The toolkit includes a control panel that tracks victim sessions in real time, collecting usernames, passwords, credit card details, PhotoTAN codes, and personal identification information.
Varonis reports that this multi-step method aims to evade European banking security, including two-factor authentication.
Spiderman uses advanced anti-detection features like country allow listing, ISP filtering, and device-type restrictions. These features allow attackers to bypass security scanners and automated detection tools by blocking traffic from data centers, VPNs, and research groups.
The kit now focuses on cryptocurrency users, including modules for extracting seed phrases from Ledger, MetaMask, and Exodus wallets, indicating a trend toward hybrid banking and crypto fraud.
