Sailor Framework

The Sailor Framework has emerged as a highly specialized Chinese-backed phishing ecosystem, moving away from broad industry attacks to dominate a specific vertical: U.S. state government and tolling infrastructure. By utilizing AES-encrypted WebSockets and modular “branches” like Sailors and globalConfig, the platform evades traditional detection while harvesting sensitive payment and identity data through urgency-based lures.