The Evolution of Phishing Panels: From Home-Crafted Scripts to Cloud-Based SaaS Solutions with Tech Support

[Professor]

Abstract: Phishing is one of the oldest and most persistent threats on the internet. While it was once the work of lone individuals copying email service HTML code, today it's a highly organized industry. Its driving force and key tool is the phishing toolkit (or kit). This article traces the evolution of this toolkit: from simple, home-made scripts to sophisticated cloud platforms that are little different from legitimate SaaS services. We examine this transformation not with judgment, but with interest in how the pursuit of efficiency, convenience, and lowering the barrier to entry is shaping the market even in its most shadowy corners.

Introduction: What is a phishing panel and why is it needed?​

A phishing panel is software that is deployed on a hacked or rented web server. Its main purpose is to automate the phishing attack process. It:

1. Hosts fake pages (clones of banking websites, social networks, corporate portals).
2. Accepts and stores data entered by victims (logins, passwords, card details, 2FA codes).
3. Manages the sending of letters or messages.
4. Provides the attacker with a convenient interface to control the entire campaign.

It's the "control panel" for a phishing attack. And its development mirrors the digitalization of criminal activity.

1. The Age of Craftsmen (2000s – Early 2010s): Hand-Written Scripts​

At the beginning of the journey, everything was based on the enthusiasm and skills of individual individuals.

• Technologies: A simple PHP script, often written using a tutorial from a hacker forum. Sometimes a combination of two files: index.php (the fake page itself) and mail.php or log.txt (where the data was sent and saved).
• Functionality: Minimal. The page is static, and data is sent to the attacker's email or to a text file on the server, which must be periodically checked. There is no protection against anti-phishing systems or statistics.
• Entry barrier: High. Basic web development skills and the ability to find and hack a hosting service to host the script were required.
• Business model: Individual hunting. The attacker does everything themselves: creates a page, sends spam, collects data, and uses it. The campaigns are small-scale.

It was a digital equivalent of a handicraft workshop.

2. The Standardization Era (mid-2010s): Phishing Kits​

The revolution was made by the emergence of ready-made solutions - "whales".

• What is this? An archive (ZIP) containing a complete set of files for deploying a phishing page for a specific target: bank, PayPal, Facebook, Gmail. Includes HTML, CSS, JavaScript, a PHP backend, and images.
• Distribution: Free or for a small fee on specialized forums and the darknet. This has given rise to the phenomenon of script kiddies —users without in-depth knowledge who can only download an archive and upload it to a hosting site.
• Functional:
  • Automatic logging: Data is neatly saved to a database (MySQL) or a human-readable text file.
  • Admin Panel: A simple password-protected web interface appears where you can view the collected data.
  • Basic bypass techniques: Hiding code from search robots, redirects from mobile devices.
• Problems: "Whales" became a mass-market commodity. Antivirus companies quickly added them to their signatures. Pages compiled from popular whales were detected and blocked within hours. A race began: whale authors began adding obfuscation to their code to make detection more difficult.

This was a transition to a conveyor belt production of threats.

3. The Era of Professionalization (Late 2010s): Modular Panels and the First Signs of SaaS​

Phishing is becoming a business for a select few, and the tools are becoming more sophisticated.

• Modular panels: Multifunctional platforms are emerging (for example, the former "Avalanche" or "Shellphish" ). These are no longer a set of files for a single purpose, but a framework into which dozens of different phishing "templates" (themes) can be loaded.
• Key innovations:
  1. Campaign Management: You can run multiple phishing pages simultaneously for different purposes and see statistics for each in a single dashboard.
  2. Integration with email services: The panel can automatically send emails through legitimate or compromised SMTP servers.
  3. Anti-detection features: Captcha bypass, human verification (protection against analytics bots), and dynamic page code modification.
  4. Functions for bypassing two-factor authentication (2FA): Templates are appearing that, after collecting the login and password, ask for a code from an SMS, intercepting it as well.
• Monetization: The creators of such panels are switching to a licensing model . The code is not made publicly available, but is sold for cryptocurrency. A semblance of technical support is appearing on forums.

This is the stage of turning a hobby into a professional tool .

4. Modern Era (2020s–present): Cloud-Based Phishing-as-a-Service (PhaaS)​

Today we are witnessing the rise of full-fledged criminal SaaS .

• The essence of the model: the attacker ( the client ) doesn't even host the panel themselves. They rent access to a ready-made, working cloud-based phishing platform from its operator ( the provider ). Everything happens in the browser.
• Characteristics of a modern PhaaS platform:
  1. Cloud infrastructure: The platform is deployed on a network of hacked or legally leased servers around the world (CDN for phishing). This increases resilience.
  2. Intuitive web interface: Drag-and-drop builders for creating emails and pages, real-time analytics dashboards (opens, clicks, data entries).
  3. Wide selection of templates: A catalog of hundreds of relevant templates for banks, corporate services (Microsoft 365, VPN), crypto exchanges, and government services.
  4. Built-in delivery services: Integration with Telegram and WhatsApp bots, and SMS gateways. Email database selection and verification functions.
  5. Advanced Block Avoidance:
     • Proxy binding: Automatic proxy sending of emails through server chains.
     • EV Certificates: Using stolen or counterfeit SSL certificates to make pages appear legitimate (green lock).
     • Domain Generation Algorithms (DGA): Automatic registration of new domains similar to the victim's brand.
  6. 24/7 technical support: Platform operators provide support via Telegram chats or ticket systems. They assist with setup, troubleshooting, and provide advice on how to bypass blocks.
• Monetization: Clear pricing plans: Standard ($200/month for 3 campaigns), Pro ($500/month for unlimited campaigns and access to premium templates). Payment is only in cryptocurrency.

Bottom line: A modern phishing dashboard is like Mailchimp or Google Analytics for cybercriminals . It radically lowers the barrier to entry: now, launching a large-scale campaign requires only money and a basic understanding of the process.

5. The Downside of Evolution: Vulnerabilities for Defense​

Ironically, this evolution also plays into the hands of defenders.

• Centralization: Cloud-based PhaaS platforms become a single point of failure. A hack or forced shutdown of one such platform can halt thousands of campaigns.
• Templates: Using popular templates allows security systems (browsers, mail filters, anti-fraud) to quickly learn and block attacks based on recognizable signatures, even if the domains are different.
• Digital footprint: Active use of tech support, forums, and advertising of services creates a network of connections and data that can be used by law enforcement to track down operators.

Conclusion: Shadow Digital Transformation​

The evolution of phishing panels from scripts to SaaS is a striking example of shadow digital transformation . It mirrors the path of legitimate software: from custom-written utilities to packaged products to subscription-based cloud services.

This transformation is driven by the same forces: the pursuit of efficiency, scalability, and reduced operating costs . It demonstrates that the criminal market is subject to the same economic laws as the legitimate one: demand creates supply, and competition leads to product improvement.

Understanding this evolution is important not for admiration, but for a realistic threat assessment. Today, defense should target not the "lone hacker," but the criminal IT corporations offering services on the darknet. Combating them requires the same approaches as combating legal fraud: pressure on infrastructure, financial investigations, undermining trust in the provider's "brand," and, most importantly, constantly improving the digital literacy of end users — the last and most important line of defense.

Phishing has evolved from the art of deception into a technologically advanced service. And defense is also evolving from a set of rules into an intelligent, adaptive system. The race continues, but its rules are now determined by the logic of software business, albeit in its darkest manifestation.