LockPhish — Phishing Attack on Lock Screen

LockPhish is the first phishing tool that can grab Windows credentials, Android PIN and iPhone Passcode using an https link. This tool is developed by TheLinuxChoice.

This creates a fake lock-screen on target devices whenever target puts credential it captures it and sends to an attacker using a ngrok tunnel. This tool automatically detects the device. Also, track the victim’s IP address.

Key Features of LockPhish

Lock screen phishing page for Windows, Android and iPhone.
Auto-detect device.
Port Forwarding by Ngrok.
IP Tracker.

Lets start the installation process.

First, we open our terminal window and type following command to clone this tool from it’s GitHub repository:

git clone https://github.com/thelinuxchoice/lockphish

Then it will start the cloning process as shown in the following screenshot.

After finishing the process we need to go to LockPhish directory by using cd command:

cd lockphish

We need to give lockphish root access before run. To do that we apply following command:

sudo chmod +x lockphish.sh

Then we need to run the tool by using the following command:

./lockphish.sh

The main menu of LockPhish will open as showing in the following screenshot:

Here we need to put the redirecting website’s link after phishing. The default value is set to YouTube. YouTube is good for social engineering or we can put other links. Here for an example, we keep it default and hit the Enter button.

Then it will download ngrok in our Kali Linux system, and configure the phishing servers on our localhost and finally give us the Phishing URL.

Now we can send this link to our target with some social engineering techniques. When our target opens this link it will ask to redirect on YouTube.

When our target clicks here to be redirected on YouTube, the device shows the following kind of screen:

After our victim inputs his Unlock PIN we got it on our terminal.

PIN received

The same thing will work on Windows PC and iPhone, we just need to send the link it will automatically detect the type of device (Android, Windows, iPhone)

This is how we can use the phishing attack on devices lock-screen and get the login credentials.

Warning:- This tutorial is for educational purpose only. It shows how the modern-day phishing attack works. Phishing is a serious crime. If anyone does any illegal activity then we are not responsible for that.

If you liked our this tutorial then follow our blog regularly for more good quality Kali Linux tutorials. Follow us on Twitter and Instagram.for quick updates. Faced any problem or have any thoughts with this article then leave a comment below.