Scammers build phishing sites with AI: fast, cheap and without a programmer. This assembly line has a flip side. Code that hasn’t been properly reviewed is full of holes, and a researcher armed with the same AI agents managed to look inside a scam platform. What he saw wasn’t a gang of lone hackers but a company: a sales team of about thirty people, roles, a work chat, a support desk and a site that goes up in a matter of minutes.
This was the story told by Chiao-Lin Yu (Steven Meow), a threat researcher at Trend Micro from Taiwan, at the 39th Chaos Communication Congress in Hamburg at the end of December 2025. Below is a breakdown of his talk: how the scheme works, what to do to avoid falling for it, and what lesson people who build sites with AI themselves should take from the story.
The scheme: a free item, cheap delivery, a “blocked account”
It all starts on social media. An ad appears on Facebook, Instagram or Threads: giving away an item for free or almost free, just pay for delivery. The person messages the “seller”, who sends a link to a site where you have to enter your name, phone number and address and transfer a small sum for delivery. In the talk it’s €2–5. The money goes by transfer to an account that doesn’t even belong to the scammers: according to the speaker, it’s often the bank details of a charity.
The point of this step isn’t the money. It’s a gullibility test. By the scammers’ logic, anyone who pays for delivery will keep giving in. They don’t push those who hesitate: it pays better to work with people who have already said “yes”.
Next the site says the seller’s account has been blocked because the buyer failed an identity check, and asks the buyer to contact “customer support”. Support can see all the details the victim entered on the site, which greatly increases trust. In the scammers’ panel the researcher found a fake screenshot generator: a banking app notification saying that more than €2,000 has been frozen in the account. The person has already paid once, the deal seems real, and now the “bank” is writing about a freeze too. Panic sets in, and the victim transfers a serious sum to “unblock” the money.
The talk is about a specific Taiwanese version: fake delivery via convenience stores. But the mechanics are universal and easy to recognise in other countries. In the Russian-speaking world it’s the long-running scheme with a fake “safe deal” on classifieds sites, and the same tricks apply to any local buy-and-sell groups, Pattaya’s included.
Five signs of a delivery scam
The scheme rests on three tricks: a cheap bait, a small first payment and urgency. Any one item on the list below is enough reason to stop; two or more, all the more so.
- Free or almost free, but with delivery paid via a link. A proper marketplace doesn’t ask you to pay for delivery on a separate site that the seller sent you to in a private message.
- The transfer isn’t to the marketplace or the delivery service. The recipient is a private individual, a charity or a company with nothing to do with the deal.
- The site asks for more information than delivery needs. Card number, SMS codes, a photo of your ID.
- After the first payment, “something went wrong”. A block, an identity check, frozen funds and a demand for another transfer to “unblock” them. This is the main sign: real services don’t make you pay your own money to unblock an account.
- A screenshot instead of a notification in your banking app. If the bank has frozen something, you’ll see it in your own app or hear it from the bank on its official number, not in a picture from “support”.
If you’re in Thailand and have already transferred money, call the 1441 hotline. It’s the centre for fighting online fraud; it works around the clock and, together with your bank, can quickly initiate a hold on transactions on a suspicious account. A police report is filed online at thaipoliceonline.go.th. The sooner the better: money from these schemes moves on within hours. It’s a different story when scam money lands in your account via a P2P exchange; we wrote about that in the article how to avoid someone else’s scam and a frozen account.
How the researcher got inside
It started with something mundane: a friend received a suspicious message and asked him to check the link. Yu works in a red team, meaning he looks for weak points in systems professionally, and decided to try out new AI pentesting tools at the same time. According to him, the site was foreign, and he assessed the legal side in advance. That’s his personal statement about his own situation, not a universal permission (we’ll come back to the law at the end).
During the research he took apart not one site but several similar platforms; for clarity, the findings below are laid out as a single chain, but they come from different, if closely related, systems.
The work was done by AI agents: Claude Code and Gemini for analysis and reasoning, and the open-source projects Strix and HexStrike for running security testing tools. According to the speaker, he didn’t write a single line of code himself. His role was to set tasks, steer the agents and make decisions. The AI took on the boring part: brute-forcing and reading thousands of lines.
This isn’t a hacking guide but a breakdown of what turned out to be weak. Almost all of them are basic hygiene mistakes from any security textbook, and for those who write backends themselves, the chain is useful as a checklist of what not to do.
Reconnaissance and a forgotten backup. The agent ran a directory scan and found a file with a .bak extension: a forgotten backup of the source code. This is a classic bad practice: a backup sitting in the web root hands part of the code to anyone who knows the file name. The code immediately showed where unsafe SQL queries were being built.
SQL injection. Parameters were inserted into queries directly, without prepared statements, so content from the URL changed the query itself. A telling detail about false protection: the site only accepted requests from a “mobile” browser, which threw off the automated scanner but did nothing to close the injection. Restricting by browser type isn’t protection against SQL injection. Through the vulnerable parameter the researcher pulled the administrators table from the database. There was also a table with 85 columns: according to the speaker, it accumulated that many fields because one and the same structure serves many different fake templates.
Default passwords. The hidden login page was found by the same brute-forcing of file names. It asked only for a password, and the one extracted from the database didn’t work, but brute force did: the password was literally admin. Separately, the login and password for the database itself were the same single letter, q. Any default password in production is an open door.
Someone else’s web shell. Behind the login page there wasn’t an admin panel but a web shell, meaning someone had already left a way to run commands on the site. The speaker doesn’t say for sure where it came from and offers several versions: the platform’s developer may have built in a backdoor “for quick edits”, it may have been a stub in the installation package, or others may have hacked the site before the researcher. For your own projects the conclusion is the same whichever version is true: “temporary” access for convenience is exactly the entrance an outsider will use.
An outdated system and privilege escalation. The server ran on a 2020-vintage stack (PHP 5, old Linux) with no updates. Direct execution of system commands was cut back by the disable_functions directive, but that disables individual PHP functions rather than isolating the application. The PHP documentation warns plainly that it isn’t full protection, and in this configuration the restriction proved insufficient. Then a publicly known vulnerability, PwnKit (CVE-2021-4034), did the rest. It isn’t a remote exploit but a local privilege escalation: it sits in the pkexec utility from polkit, which is installed by default on almost every Linux distribution, and raises existing access to root. Qualys disclosed it and fixes were released in January 2022, but there are still plenty of unpatched servers. The speaker addresses admins directly: update polkit. Under the hood, the platform turned out to be built on the 宝塔 control panel (BT-panel; its international version is aaPanel), an all-in-one panel popular in China with nginx, MySQL and a WAF that brings up a web server in minutes with no knowledge of Linux.
A check that checks nothing. When the researcher downloaded the whole installation package and gave it to Claude Code, it pointed out more than twenty problem spots: SQL injections, file upload bypasses, hardcoded passwords. The most telling was a logic error in file uploads: the code checked the extension and printed an error if it was wrong, but didn’t call return or exit, so execution carried on and the file was saved anyway. A hole like this is easy to miss by eye in a review, but a machine spots it. Another path to code execution turned up where user data from the settings page was written straight into an executable PHP config file, and the filter that was supposed to weed it out didn’t cope. The lesson: user data must never be written into executable code, and a “check” that doesn’t stop execution isn’t a check.
“Vibe purple” as evidence
AI-generated interfaces have a recognisable signature: Tailwind’s purple-blue gradients. The scammers’ panels looked like that too. The speaker calls this colour “vibe purple” and seriously suggests using it as one of the signals when hunting for suspicious sites.
Where it came from is a story in itself. The common explanation: at one point, buttons in Tailwind UI components were indigo by default, examples with them spread across the internet and, by this account, ended up in the models’ training data. In summer 2025 Tailwind’s creator Adam Wathan jokingly apologised on social media for making AI interfaces purple everywhere with his choice of default. That doesn’t prove cause and effect, but the observation is amusing and has stuck.
The colour proves nothing on its own: thousands of honest sites look like this too. But together with other signs it gives a researcher more reason to take a closer look at a site.
Scammers as a company
The really interesting part was inside. The platform turned out to be a full-blown system for running the “business”. It has a catalogue of bait items: a scammer adds an item and gets a new link for victims. There’s an orders section with names, phone numbers, addresses and screenshots of transfers. There’s a generator for those very fake bank notifications. And there’s a Telegram bot that reports every new victim to the work chat.
The chat messages paint a picture of an ordinary sales department. A successful deal gets congratulations. If a site breaks, people report it in the group chat, and towards midnight the team “closes the shift” and switches to a new server and domain. Among the victims was a thirteen-year-old schoolboy who was talked into asking his family for money.
From the logs the researcher reconstructed the group’s structure: a technical lead, an operations lead, a core team and more than thirty “sales” members in the chat who look for victims on social media and handle the conversations. Roles, division of labour and, according to the speaker, even KPIs: just like a real company. The researcher showed the members’ names, but we don’t reproduce them here.
Four minutes per site, one minute per domain
The server control panel’s logs showed how fast the group works. According to those logs, a new phishing site with everything it needs (code, database and SSL certificate) is deployed in about four minutes, and switching domains takes about a minute. This is an observation about one specific platform, but the order of magnitude is telling.
Hence the talk’s practical conclusion: manual domain blocking alone is no longer enough. By the time an anti-fraud service or a government register adds an address to a blacklist, the group has already moved. According to the speaker, several new sites appear in place of each blocked one.
The platform is also evolving fast. The researcher found several versions over a few months of 2025: in the first, support ran through the QQ messenger; the second added semi-automation and voice notifications; the latest has AI-generated commands and management of several groups at once.
A 20-yuan platform and hundreds of forks
Following a clue from the platform itself, the researcher found tutorials on the Chinese video platform Bilibili on how to deploy such a server, even from a phone, without a computer. In the comments people discussed the price: the platform costs about 20 yuan, roughly two and a half euros. Its source code circulates online in a “13 in 1” bundle, with templates for thirteen different marketplaces.
The Taiwanese version where it all began matched this bundle by more than 80%. The story looks like a malware family tree: the original version appeared in 2016, in 2020 a fraud platform for China was built on it, and then a fork for Taiwan appeared. The speaker showed that there aren’t two forks but hundreds. The same backend with different storefronts works against people in Taiwan, Japan, China and Hong Kong.
The details speak for themselves. The code contains abusive comments aimed at anyone who tries to copy the platform, while the code itself is freely available. In one version the developer closed a hole in file uploads and immediately opened another in the same file. And the Taiwanese copy lacked the licence check present in the original: by all appearances, the scammers were running a cracked version.
Shared code is both bad and good news. Bad: the scheme scales almost for free. Good: a vulnerability found in one fork is usually present in the others, and shared traits make it possible to find new sites. The speaker deliberately didn’t explain how exactly to find them, so that scammers in the audience wouldn’t learn to evade the search. But he did give the scale: on one day in October his team found more than twenty new sites on a single template.
What to check on your own site after vibe coding
The root cause of this story isn’t a hacker but code without proper review. Everything suggests the platform was built with AI and shipped without being read properly. Someone who builds a landing page or a bot for their business in an evening takes the same path. The only difference is that the scammers got a visit from a researcher, while you might get a visit from anyone at all.
Almost everything the researcher used to get inside can be checked in an hour before going live. A short checklist based on the talk:
- the web root contains no backups or archives of source code (
.bak,.zip,.sql), and the code contains no passwords or tokens; - user data is never glued directly into an SQL query: prepared statements only;
- not a single default password and not a single
admin; the database has a login and password that can’t be guessed; - no “temporary” web shells or backdoors “for quick edits”: those are exactly what outsiders use;
- the system and packages on the server are up to date: local vulnerabilities like PwnKit are patched, not left waiting for someone who has already got inside;
- a check that forbids something actually stops execution (
return/exit) rather than just printing an error and carrying on; - after generating code, you separately asked the model to find vulnerabilities in it and read the answer.
The last point is exactly what the researcher did: he gave the code to the AI and asked it to find the holes. In a single pass the agent produced more than twenty findings. They need checking by hand, of course, but as a first sieve it works. If your agent writes code, have it review that code too, before someone else does. We covered how to set up that kind of work with an agent in the article from vibe coding to engineering.
“Only AI can beat AI”: what’s changing in phishing defence
The speaker closes with three points. First: fighting schemes like this by hand is pointless. You need automatic real-time monitoring of new domains, and a local language model right in the user’s browser can check suspicious links. Second: countries and teams need to share threat data, because one platform operates in several countries at once, and a finding in Taiwan helps in Japan. He puts the third this way: in the age of AI only AI can beat AI, and that’s not a slogan but reality. Scammers have already automated sites, messages and attacks. Anyone who doesn’t use AI for defence will always be a step behind.
The same automation also works on the other side, this time against ordinary sites: NorForge researchers found about twenty open control panels from which AI agents attack online shops with almost no human involvement. The breakdown is in the article AI agent attacks from the inside.
And an important caveat about the law. The speaker himself stresses that before doing anything you need to understand the laws of your own country, and those are his words about his own situation, not a general exception that “scammers are fair game”. A foreign server and a careful researcher don’t mean that anyone is allowed to access someone else’s system. An ordinary user who runs into scammers shouldn’t “hack back” but should save the messages and links and report it to the bank and the police straight away. In Thailand, unauthorised access to a computer system is a criminal offence under the Computer Crime Act, and the motive “but they’re scammers” doesn’t exempt you from liability.
This article is based on the talk by Chiao-Lin Yu (Steven Meow), “When Vibe Scammers Met Vibe Hackers: Pwning PhaaS with Their Own Weapons”, at 39C3 (2025).
