Loading malware…
1Phish is an evolving, multi-stage phishing kit/campaign targeting 1Password users. Reporting describes its progression from a basic credential-harvesting HTML page (first observed September 2025) into an MFA-aware, anti-analysis phishing framework by February 2026.
High-confidence behaviors and capabilities described:
Infrastructure/artifacts and IOCs explicitly mentioned:
Assessment notes included in the content:
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Phishing kit used to target 1Password users, with capabilities including one-time password (OTP) harvesting to defeat MFA.
A multi-stage phishing kit that evolved from credential harvesting to include pre-phishing fingerprinting/validation, bot filtering via browser fingerprinting, and harvesting of secondary authentication material such as OTPs and recovery codes (notably targeting 1Password users).
An evolving, operationally mature phishing kit targeting 1Password users. It implements staged credential harvesting (email/secret key/password), adds MFA/OTP capture (and in later versions recovery code capture), and includes anti-analysis/anti-bot measures such as browser fingerprinting, automation-tool detection, Cloudflare challenges, and traffic filtering/cloaking via HideClick. Later versions introduce session management and a REST-style API backend to manage multi-step victim flows and gating/validation decisions.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.