List of Configurations

Configuration settings
shadow v1
ghost v2
phantom v3
abyss v4

Platform

Windows

Windows

Windows/macOS

Windows/macOS/Android

Extension installation format

Via .zip

Via .crx

Via .crx

Via Google extension store

Developer Mode must be enabled

+

+

-

-

Crypto wallets

+

+

+

+

Banks

-

-

+

+

Paid fee payment

+

+

-

-

IP/UserAgent

+

+

+

+

Screen screenshot

+

+

+

+

Screen video recording

-

-

-

+

Webcam photo

-

-

+

+

Webcam video

-

-

-

+

Browser history

-

+

+

+

Cookies, sessions and bookmarks

-

Bookmarks only

+

+

Passwords and logins

-

-

+

+

Fake seed-phrase input forms

-

-

+

+

Seed-phrase input interception

-

-

-

+

API keys

-

-

-

+

Redirects (URL replacement)

-

-

+

+

Search results substitution

-

-

-

+

Address/card replacement on copy

-

-

+

+

Transaction data interception

-

-

+

+

Crypto-wallet auto-checker

-

-

-

+

Commands in the logs chat

-

-

+

+

Design change

+

+

+

+

Change logo

+

+

+

+

Adding your own design

Personal only

Personal only

+

+

Add your own logo

+

+

+

+

Change site name

+

+

+

+

Add your own links

+

+

+

+

Configuration: What it is and what it’s for

Configuration settings are located in Main Menu - Panel - Your domain - Configuration {example.com}. They determine which data is collected from the domain.

  1. Crypto wallets/Banks

What it is: What exactly you will work with. CIS banks are strictly prohibited!

How it works: Turn on what you will work with; you can enable crypto wallets and banks.

Example of use:

  1. Min. amount

What it is: Minimum amount to withdraw from the victim. How it works: Click Min. amount → Select an amount ($100, $200, etc.). Example of use: Set $500 to focus on larger profits.

  1. Fee payment

What it is: pays the network fee What it’s for: Allows paying the network fee when transferring from the victim’s wallet How it works: Deducts balance to pay the fee. Click Fee payment to enable the feature.

  1. IP/User-Agent

What it is: Collecting the IP address and information about the user's browser/device. What it’s for: Shows what IP and User-Agent the victim has. How it works: The bot logs the IP and User-Agent. Example of use: Enable to log victims' data.

  1. Screen screenshot/Screen video recording, or from webcam

What it is: Recording screenshots or video from the user's screen/webcam. What it’s for: Allows visually monitoring the user's actions. How it works: If enabled, the bot saves screenshots or videos in a .zip, and you can request the action screenshot/video recording from screen/webcam in your logs chat Example of use: Enable to check what users do on the site and in front of the computer.

  1. Browser history

What it is: Collecting data about sites visited by the user. What it’s for: Helps understand the context of the user's visit. How it works: The bot logs the history. Example of use: Enable to know which sites interest users.

  1. Cookies, sessions and bookmarks

What it is: Collecting cookies, sessions and passwords entered on the site. What it’s for: Allows gathering data for analysis. How it works: The bot saves the data in a .zip archive; you can request an action in your logs chat to show cookies, sessions, bookmarks Example of use: Enable to collect credentials

  1. Passwords and logins

What it is: A tool for saving passwords and logins that the victim left in saved browser passwords.

What it’s for: For working with or analyzing the victim, passwords from banks and crypto platforms

How it works: Saves all passwords and logins and sends them to you in a .zip file in the panel, or to a command in the logs chat.

  1. Fake seed-phrase forms

What it is: Fake forms on the site that request seed-phrases. What it’s for: Collects seed-phrases for crypto wallets. How it works: If enabled, forms appear on the site that record entered data. For example, when the victim has an extension like Trust Wallet, a fake form is shown asking to enter seed-phrases to log back into the wallet. Example of use: Enable for crypto domains.

  1. Seed-phrase interception

What it is: Automatic collection of seed-phrases entered by the user. What it’s for: Makes obtaining seed-phrases easier without fake forms. How it works: The bot intercepts seed-phrases and saves them in the logs. Example of use: Enable for automatic collection of seed-phrases.

  1. API keys

What it is: Collecting API keys entered by the user. What it’s for: Allows obtaining access to the user's API services. For example Binance How it works: The bot records keys in the logs. Example of use: Enable if the domain is related to services that use APIs.

  1. Redirects (URL replacement)

What it is: Replacing URLs that the user navigates to. What it’s for: Directs the user to pages you specify. Perfect for bank phishing. How it works: The bot replaces links on the site, logging the actions. Example of use: Enable to redirect to your resources.

  1. Search results substitution

What it is: Changing search results on the site. What it’s for: Allows showing users the search information you want. For example, if they enter: Is your site a scam or not - sites stating it is not may be shown. How it works: The bot substitutes search results, recording the data in the logs. Example of use: Enable to control the information the user sees.

  1. Address replacement on copy

What it is: Replacing an address (for example, a crypto wallet) when the user copies it. What it’s for: Allows redirecting funds to your wallet. How it works: The bot replaces the copied address with the one you specified. Example of use: Enable for crypto transactions.

  1. Transaction interception

What it is: Collecting data about transactions performed by the user. What it’s for: Tracks financial operations for analysis or profit. How it works: The bot logs transaction data. Example of use: Enable to monitor crypto payments.

  1. Auto-checker

What it is: Automatic verification of collected data (for example, passwords, seed-phrases). What it’s for: Verifies the validity of data without your involvement. How it works: The bot automatically tests data (for example, checks access to wallets) and notifies about the results. Example of use: Enable to save time on verification.

  1. Commands in the logs chat

What it is: Commands to record video from the camera or screen, as well as a screenshot of your victim

What it’s for: To view the victim's actions on the site or in front of the screen.

How it works: Operates via commands: /vid 15s victim_id, where /vid - command, 15s - 15 seconds, id - your victim's id. Commands work in your logs chat. To view all commands enter /help in the logs chat.

How to set up: In Configuration {example.com} click the button (for example, Crypto wallets: On/Off) to enable or disable the feature.

Last updated