SocialFish is a phishing toolkit designed for capturing credentials, cookies, and two-factor authentication codes from cloned login pages.
The tool addresses the challenge of testing authentication security by automating the creation of convincing phishing pages that can capture modern web authentication flows. It uses Playwright browser automation to clone JavaScript-heavy login pages, operates a live operator panel for real-time monitoring, and intercepts session cookies and OTP codes. The toolkit includes a template system for reusing clones, webhook notifications to external services like Slack and Discord, and automatic detection of multi-step authentication flows found on platforms like Office365 and Gmail.
This tool is intended for authorized penetration testing and security research within controlled environments. It suits red team exercises and security assessments where testing the human and technical layers of authentication is part of the engagement scope. The project positions itself as a modern alternative to earlier phishing frameworks by emphasizing support for contemporary web technologies including single-page applications and two-factor authentication interception. It works with any login page using HTML forms, JavaScript submission, XHR/fetch requests, or SPA frameworks.
Development activity shows consistent refinement of core capabilities. The project maintains active documentation including feature guides and implementation details. Updates focus on expanding browser automation support and adding infrastructure for real-time operator interaction with captured sessions. The codebase receives ongoing attention to support emerging authentication patterns and integration points with external notification systems.
