Phishing kit
Also called phishing-as-a-service, phishing kits
Ready-made software sold to criminals that sets up fake login or payment pages and collects what victims type, no skill needed.
Most phishing isn't built by the people who send it. It's rented. Phishing kits package everything: copies of bank, delivery and government pages, message templates, hosting tricks to avoid being blocked, and a panel where stolen details arrive. Some sit between you and the real site, passing your password and code along live so the criminal ends up logged in as you.
AI has made the kits easier still. Netcraft reported that one large kit, darcula, added generative AI so criminals can create phishing forms in any language without coding, and that a beginner could deploy a customised fake site in minutes.
That's why phishing feels relentless: one kit serves thousands of criminals. The defence that scales back is a login a fake page can't use, such as a passkey.
For example
For a monthly fee, a criminal gets copies of hundreds of brands' pages, text-message templates and a dashboard of stolen cards.
Put it to use
Where you'll meet phishing kit in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.