InfoSecBulletin Cybersecurity for mankind
A new phishing kit called “Spiderman” poses a serious threat to European bank customers, allowing cybercriminals to easily generate realistic fake login pages for multiple banks.
The Spiderman phishing kit is notable for its all-in-one design, combining login templates for various European banks and cryptocurrency platforms into a single, easy-to-use interface.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
Spiderman offers attackers pre-made clones of major banks in five countries, such as Deutsche Bank, Commerzbank, ING, and CaixaBank, unlike traditional phishing kits that target specific institutions.
Security researchers found around 750 members in a Signal messenger group linked to the toolkit’s seller, showing its widespread use in the cybercriminal community.
Spiderman’s danger lies in its automation. Attackers don’t need web development skills or technical know-how to execute advanced phishing schemes.
The kit simplifies the process for criminals to choose a bank, create an exact copy of its login page, and launch phishing attacks quickly. The toolkit includes a control panel that tracks victim sessions in real time, collecting usernames, passwords, credit card details, PhotoTAN codes, and personal identification information.
Varonis reports that this multi-step method aims to evade European banking security, including two-factor authentication.
Spiderman uses advanced anti-detection features like country allow listing, ISP filtering, and device-type restrictions. These features allow attackers to bypass security scanners and automated detection tools by blocking traffic from data centers, VPNs, and research groups.
The kit now focuses on cryptocurrency users, including modules for extracting seed phrases from Ledger, MetaMask, and Exodus wallets, indicating a trend toward hybrid banking and crypto fraud.
