ZeroTokens Phishing Platform Enables Real-Time Attacks on Financial Institutions

The ZeroTokens phishing platform has been identified as a sophisticated tool enabling real-time phishing attacks against financial institutions. Attackers can monitor victims' sessions and adapt prompts based on the information entered, allowing for the collection of sensitive data such as login credentials and personal identification. Over 45,000 phishing emails were sent to more than 24,000 recipients, targeting over 700 organizations. The campaign utilized ten sender domains and nine compromised SendGrid accounts, successfully passing SPF, DKIM, and DMARC checks. The phishing scheme leveraged W-8BEN tax-documentation reviews to create a believable pretext for the victims. ZeroTokens mimics the verification processes of 53 financial institutions and can present multiple stages of interaction. The platform does not facilitate direct financial transactions but allows attackers to use collected data for subsequent fraud. Abnormal AI published its findings on August 25, 2026, detailing the operational mechanics of ZeroTokens and its implications for cybersecurity defenses.

Key Points: • ZeroTokens allows real-time monitoring and manipulation of phishing attacks. • Over 45,000 phishing emails targeted 24,000 recipients across 700 organizations. • The platform mimics legitimate financial institution verification processes.