Threat Research · securitylabs.datadoghq.com

1Phish Kit Evolves to Capture 1Password MFA and Recovery Codes

Feb 27, 2026 · Original article ↗

Summary

Datadog researchers traced 1Phish through four versions (September 2025–February 2026), documenting its shift to an API-driven kit that fingerprints victims and captures 1Password credentials, OTPs, and recovery codes. No reverse-proxy infrastructure was observed.

Key points

Captured DOM snapshots show four versions evolving from basic credential pages into a multi-stage, REST API-driven phishing kit.
The kit captures 1Password emails, secret keys, and passwords; later versions add OTP capture, and V4 also collects 1PRK recovery codes and targets enterprise sign-ins.
Browser and device fingerprinting, bot scoring, automation checks, and HideClick cloaking help filter visitors and hinder automated analysis.
Shared frontend artifacts, workflow endpoints, fingerprinting logic, and infrastructure reuse link the versions to a common kit lineage; the operator relationship remains unclear.
Researchers observed 11 typosquatted domains, 10 of them fronted by Cloudflare.
The researchers found no direct evidence of reverse-proxy tooling or automated session hijacking; OTP collection is consistent with intent to enable real-time authentication abuse or session replay.
1Password is monitoring the campaign and pursuing takedowns; the article advises users to avoid unsolicited links and enter credentials only on verified domains.

Article Details

Attack Vectors: Breach- and security-themed emails impersonated 1Password alerts and directed recipients to typosquatted login domains.
Fake 1Password pages collected email addresses, secret keys, and passwords; later versions also collected one-time passcodes and recovery codes.
The kit fingerprinted browsers and devices and used bot scoring, automation checks, and HideClick cloaking to gate access and serve benign content to investigators.
The V4 kit used staged REST API requests to manage phishing sessions and submit credentials, OTPs, and recovery codes.
Defensive Notes: Treat unsolicited breach or security-themed emails cautiously; avoid embedded links and navigate directly to a known 1Password sign-in URL.
Enter credentials, one-time passcodes, and recovery codes only on verified 1Password domains.
Monitor for anomalous authentication events, including unusual login attempts from Cloudflare-hosted infrastructure; the article notes these may indicate account compromise.
1Password and monitoring vendors are tracking the campaign and pursuing takedowns of malicious lookalike sites; infrastructure rotation means monitoring should continue.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`0nepass-word[.]com`	Typosquatted phishing domain used for a V3 deployment of the 1Phish kit.
DOMAIN	`1pass-wrd[.]com`	Typosquatted phishing domain listed for a V4 deployment of the 1Phish kit.
DOMAIN	`1passwod[.]net`	Typosquatted phishing domain used for a V3 deployment of the 1Phish kit.
DOMAIN	`1passwords[.]co`	Malicious lookalike domain associated with a V3 phishing-kit deployment.
DOMAIN	`1possword[.]com`	Typosquatted phishing domain used for a V3 deployment of the 1Phish kit.
DOMAIN	`login-1password[.]com`	Typosquatted phishing domain used for a fake 1Password sign-in page.
DOMAIN	`lon-pass-word[.]com`	Typosquatted phishing domain used by the 1Phish kit.
DOMAIN	`lpasswod[.]com`	Typosquatted phishing domain used for a V3 deployment of the 1Phish kit.
DOMAIN	`on-pass-word[.]com`	Typosquatted phishing domain used for a V3 deployment of the 1Phish kit.
DOMAIN	`on-pssword[.]com`	Typosquatted phishing domain used for a V4 deployment of the 1Phish kit.
DOMAIN	`one-passw0rd[.]com`	Typosquatted phishing domain used for a V3 deployment of the 1Phish kit.
DOMAIN	`onepass-word[.]com`	Typosquatted phishing domain used by the 1Phish kit, including for fingerprint telemetry.
DOMAIN	`signin-1psswoord[.]com`	Typosquatted phishing domain used for a V4 deployment of the 1Phish kit.