Most credential-phishing kits are automated end to end: a victim lands on a cloned login page, types a username and password, and a script silently forwards whatever was typed to wherever the attacker checks in later. Abnormal AI’s research, published August 25 and covered by Infosecurity Magazine, describes something built to a different design. A platform called ZeroTokens puts a human being on the other end of every session while it is still happening, watching what a victim types and deciding, screen by screen, what that victim sees next.
A Console Instead of a Static Page
ZeroTokens keeps a persistent connection open between the fake login page and an operator console for as long as a victim is on the line. As a target types a username, a password, a one-time code, the platform relays that input to the console in real time rather than storing it for later. A live operator watching the feed then chooses what screen the victim sees next: an additional verification prompt, a request for a driver’s license photo, a field asking for a trading account password. If a victim’s first attempt at a code fails, the operator can simply show another prompt and keep the session alive instead of letting it die the way an automated kit would. That single design choice, a person making decisions turn by turn instead of a script following a fixed sequence, is what lets ZeroTokens adapt to friction the way a real login flow would.
Fifty-Three Institutions, One Tax Form as an Excuse
The campaign Abnormal AI traced sent more than 45,000 messages to over 24,000 recipients across more than 700 organizations, with roughly 24,000 of those messages going out on a single peak day. The pretext was a request to review a W-8BEN, the IRS form foreign holders of US securities have to keep current, timed at recipients who plausibly held US brokerage accounts. Behind that pretext sat template libraries covering 53 financial institutions and 36 card issuers spanning banks and brokerages in multiple regions, and a data-collection flow built to harvest login credentials, ID and card details, SMS verification codes, app-based approval confirmations, and a separate trading password. The console itself had distinct super-admin and operator roles, which led Abnormal AI to conclude with high confidence that ZeroTokens is proprietary tooling built for one group’s own use rather than a kit rented out to many customers the way most phishing-as-a-service platforms work.
A Live Relay Is Still Just a Sending Problem to DMARC
The messages that carried victims into this console went out from ten sender domains routed through nine abused SendGrid accounts, and they passed SPF, DKIM, and DMARC cleanly, because SendGrid is a legitimate email service with its own properly configured authentication, and DMARC only checks whether the domain in the From header had the authority to use the infrastructure that sent it. It says nothing about who is watching the session on the other end of a link once a recipient clicks it, and nothing about whether a human operator is relaying a one-time code into a real bank’s login page within the few seconds that code stays valid. That relay, stolen credentials and codes fed live into the genuine institution while a victim believes they are completing their own login, is exactly the kind of real-time fraud that authentication protocols were never built to see, because it happens entirely on infrastructure and in a browser session DMARC has no visibility into.
What This Means for Your Program
Do not assume time-limited one-time codes are safe from phishing just because they expire quickly. A live operator relaying a code into the real institution within its validity window defeats the entire premise of a short-lived OTP the same way an automated adversary-in-the-middle proxy does, just with a person instead of a script doing the relaying.
Watch for legitimate transactional email services being used as phishing delivery infrastructure. SendGrid, like any bulk sender, will pass SPF, DKIM, and DMARC for mail sent through it, so a security stack needs to inspect sender reputation and campaign patterns at that provider level, not just trust that authenticated mail is safe mail.
Treat unusually persistent or adaptive phishing pages as a signal, not an inconvenience. A page that keeps re-prompting after a failed verification attempt, rather than simply erroring out, is a strong indicator of a live operator on the other end rather than a static kit, and that distinction should change how a security team responds to a reported link.
Build user reporting paths that capture behavioral detail, not just the link. A user who says “it kept asking me for different things” after a failed code attempt is describing exactly the kind of adaptive, human-operated session this research documents, and that detail is worth more to an investigator than the URL alone.
The Takeaway
ZeroTokens is a reminder that the most dangerous phishing platforms are not always the ones with the most technically sophisticated infrastructure. This one succeeds by putting a person back into a process the industry has spent years trying to fully automate, because a human noticing a failed code and simply asking again beats a script that gives up. None of that has anything to do with whether the domain that sent the initial email had the authority to do so, which is the one question DMARC exists to answer and the one question a live operator watching your session was never going to be stopped by.
DMARC tells you whether a domain had the authority to send a message. It cannot tell you whether a human being is watching the session your click leads to and steering it in real time. Excello Mail turns your DMARC aggregate reports into a clear, continuous record of every service, including bulk senders like SendGrid, sending as your domain, so the layer authentication actually covers stays watched while your team builds the defenses for everything a live operator can do past the click. Sign up for free to Excello Mail and get that foundation in place.