A newly uncovered phishing operation targets Spanish-speaking Microsoft Outlook users, employing AI-assisted code generation and shifting command-and-control (C2) channels to Telegram and Discord to facilitate data exfiltration.
Discovery of the “Mycelial Mage” Kit
Security researchers observed the first signs of this kit around March 2025, though analysis began in August. The campaign, informally named Mycelial Mage, was built to mimic Microsoft Outlook login pages and harvest user credentials along with IP and geolocation data.
The kit’s signature feature is the unusual string “🍄🍄0UTL🍄🍄” embedded in its source code a distinctive marker used to track related samples.
Dozens of infected domains bearing this signature were subsequently identified via URLScan searches, revealing consistent structures indicative of a coordinated, service-based operation rather than sporadic reuse.
Early variants used a script named xjsx.js, which stored operators’ Telegram bot tokens and chat IDs after light obfuscation.
This modular approach enabled attackers to rotate credentials without modifying the core phishing logic. The campaign later evolved into a hardened version, called tlgram.js, which introduced advanced anti-analysis techniques.
These included dynamic debugger traps, console hijacking, and self-referential regular expression triggers designed to hinder both static and runtime inspection, indicating deliberate code protection rather than amateur scripting.
Shift to Discord and AI Influence
More recent variants, such as disBLOCK.js, have replaced Telegram-based exfiltration with Discord webhooks. In this version, all logic was clearly documented in Spanish, with correctly formatted functions and consistent indentation, suggesting AI-assisted development.
The shift from Telegram to Discord also improved operational security. While Telegram bots expose message histories to analysts holding valid tokens, Discord webhooks work as one-way “write-only” channels that prevent defenders from viewing or replaying stolen data.
Across all discovered variants, the exfiltration workflow stayed constant. Stolen credentials were enriched with metadata obtained from api.ipify.org and ipapi.co, then sent via HTTPS POST requests in a standardized format bearing the fungal emoji markers.
Sagehollow concluded that the stable structure, shared exfiltration sequences, and interchangeable use of C2 channels point to a phishing-as-a-service model.
This ecosystem appears to maintain multiple operational branches, ranging from older, unmasked versions to AI-enhanced variants, that circulate continuously.
The findings underline an increasingly common trend: criminal developers adopting modular frameworks, automation, and large language models to streamline phishing operations.
As adversaries evolve toward disposable infrastructure and ephemeral exfiltration channels, defenders face growing challenges tracing or intercepting stolen data in real time.
Follow us on Google News , LinkedIn and X to Get More Instant Updates, Set Cyberpress as a Preferred Source in Google.
