Laurseraph

Laurseraph is a browser in the middle phishing tool targeting Google accounts that emerged in the second half of 2025. It had a small surge of activity at the start of 2026 before becoming a more established phishing kit throughout summer 2026.

The browser in the middle mechanism works by creating a new cloud browser session on the attacker's infrastructure that connects to the Google login form. Images from this browser are displayed to the victim in a canvas on the phishing site. Interacting with this canvas relays the victim's mouse clicks and keystrokes back to the attacker's browser.

URL patterns

The main URL that is visible to recipient is that of the anti-bot gate. This has most frequently been hosted on a Cloudflare Workers domain. Push has observed two main naming patterns during 2026:

• accounts-g0033le-com-[4].[tenant].workers.dev
  • Example: accounts-g0033le-com-1cd3.laurseraph.workers.dev, accounts-g0033le-com-f753.vn604074.workers.dev
• [word]-[word]-[4].w-[6].workers.dev
  • Examples: session-base-paperdoc-k093.w-jdfq64.workers.dev, secure-proposal-l4f5.w-kkjhaf.workers.dev

The browser in the middle phishing client page is loaded as a Blob URL with connections to the remote browser relay server being performed in the background over a WebSocket:

blob:https://silverpoints-ehax.w-jo6fbr.workers.dev/1de51af1-3cd1-4e7b-8260-29a0976af281

Network traffic

After passing the anti-bot gate, the kit sends a liveness check request to the /eal endpoint. In some deployments this was sent to a list of different central C2 servers with the first to respond successfully picked as the C2 for the follow up session creation request.

A new phishing browser session is created with a POST request to the /create endpoint:

POST /create HTTP/1.1
Content-Type: text/plain

{"hash":"307YyWxq","ttl":60,"e":"","h":"","c":"","r":"","t":"0","bl":"2","op":"0","domain":"invitation-to-bid-4xbi.w-f859x0.workers.dev"}

{"success":true,"html":"[300kb base64]","html_encoded":true,"mode":3,"mode_url":"https://accounts.google.com"}

The HTML in the response contains all of the configuration for connecting to the relay host and receiving images from the remote browser. The connection is established over a WebSocket connection to wss://<relay-host>/ws.