NakedPages

The NakedPages phishing kit has been available since 2022; accounting for a significant proportion of Push's detections throughout 2024 and 2025. It works as a transparent, reverse proxy with Microsoft 365 2FA bypass as its primary target.

NakedPages has likely seen forks and variants as part of a related family of tooling. Microsoft's reporting in 2024 showed that a shutdown of the NakedPages kit was announced on Telegram. At the same time a competing rebrand named SakaiPages was also announced.

In 2026, Push has tracked an apparent evolution of NakedPages with rewritten proxy engines and support for phishing Google accounts. The new kit is documented as DOMDIFFER; this page is dedicated to the older generation of NakedPages.

Push previously published analysis of NakedPages focussing on its evasion techniques back in July 2024.

URL patterns

The typical NakedPages proxy landing URL has an eight character lowercase query string - for example, ?mndgtsuq or ?owwrdxgu.

Distinctive URL parameters include qrc, dataXX0, and ref.

One prominent variant that was active most active from July 2024 to June 2025 used a Cloudflare Turnstile anti-bot gate with a distinctive naming pattern of [8-hex-chars].[24-hex-chars].workers.dev - for example, 47ecce9e.1511d6dfaa8e5e8a0804034d.workers.dev.

Network traffic

Given that NakedPages operates as a relatively transparent reverse proxy, the network traffic mirrors that of a genuine Microsoft sign-in flow, including:

• POST /common/GetCredentialType?mkt=en-US
• POST /common/login
• https://login.live.com/Me.htm - The consumer-account check is not routed through the phishing proxy.

Proxied assets from Microsoft's CDNs place the real host as a path segment followed by a ~ marker:

https://<proxy>/aadcdn.msauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_*.js