In June 2025, security researchers discovered a phishing kit being sold on underground forums that was specifically designed to create convincing replicas of Nexus Market. The kit included pre-built templates, automated credential exfiltration, and even a basic admin panel for managing stolen data.
The discovery highlights the commoditization of phishing infrastructure targeting darknet marketplace users. Researchers noted that such kits lower the barrier to entry for credential theft operations and contribute to the proliferation of fake marketplace sites.
The phishing kit was reported to relevant abuse teams and law enforcement agencies for takedown action.