Abnormal AI has released a comprehensive report detailing the ZeroTokens platform, a sophisticated live-operator phishing infrastructure that has evolved significantly since its initial disclosure in August 2026. The expanded investigation reveals the scope of operations, resilience, and technical sophistication, showing how threat actors have systematically targeted financial institutions globally. Since Abnormal's initial disclosure (below), the scope of the ZeroTokens campaign has expanded dramatically. The investigation has grown from 45,000 messages identified during the recent Revolut cyber incident to more than 1.2 million messages across 2,814 Abnormal customers.[1]
The threat actors have orchestrated confirmed phishing activity impersonating 25 distinct financial brands, indicating a highly coordinated and multifaceted operation targeting the financial services sector across multiple jurisdictions.
The platform's operational reach extends well beyond the initial disclosure, with researchers documenting attacks against organizations globally. The targeting strategy suggests a methodical approach aimed at maximizing credential-theft opportunities across diverse financial institutions.
A particularly concerning finding from Abnormal's research is the operators' ability to recover quickly from disruptions. After the original ZeroTokens backend was placed under registry hold, the attackers rebuilt their console on new infrastructure within approximately 20 hours. The rebuilt platform expanded its capabilities, increasing from 53 to 58 financial-brand projects, showing that defensive actions lead not to retreat but to accelerated evolution.
This rapid recovery capability indicates a well-resourced threat group with significant operational flexibility and pre-positioned backup infrastructure. The speed of recovery suggests the operators maintain redundant systems and contingency protocols, enabling continued operations despite external disruptions.
The report reconstructs the broader five-month operational timeline, documenting three distinct overlapping generations of lure infrastructure. This architectural complexity suggests a deliberate strategy to maintain operational continuity whilst evolving tactics. The operators have deployed a reusable control plane that enables dynamic management of active phishing sessions and rapid deployment of replacement lure sites using existing modular components.
The sophistication of this infrastructure reflects significant investment in platform development. Rather than deploying individual, disconnected phishing campaigns, the threat actors have built an integrated platform that can scale operations efficiently across multiple targets and geographies simultaneously.
The research identifies a critical technical capability: the platform's ability to dynamically manage active phishing sessions. This real-time control mechanism allows operators to adjust campaigns in response to defensive measures, modify lure content, and coordinate multi-stage attacks across numerous targets without manual intervention. The reusable control plane architecture enables rapid provisioning of replacement infrastructure, ensuring operational continuity even when individual components are disrupted.
The investigation documents the operation's international targeting approach, with confirmed activity across multiple continents. The diversity of targeted financial institutions and the campaign's geographic breadth indicate strategic planning designed to exploit global financial sector vulnerabilities.
This article used AI to craft the content and is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments, or assistance, please contact the office directly at 1-844-492-7225 or feedback@redskyalliance.com
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
[1] https://www.cybersecurityintelligence.com/blog/zerotokens-phishing-campaign-targets-banks-9791.html
Comments