Phish Bait

Inspiration

Over 3.5 million adults worldwide lose money to scams every day, with many of them falling victim to phishing attacks. As a way to combat this, why not scam the scammers? Phish Bait began with a deliberately mischievous plan: introducing synthetic records to make phishing-collected data less useful in real-world fraud.

What it does

The Phish Bait website connects to Steel AI and Claude AI to generate fictional names, emails, phone numbers, addresses, and notes, and to flood out phishing forms. For this demo, we cloned phishing websites from PhishTank to simulate actual fraud. When we "unleash the swarm", we can see the scammer's records become overpopulated with false information and identities.

How we built it

We built the dashboard and fictional redelivery page with Next.js, React, and Tailwind, and used the Anthropic API to generate synthetic personas. Steel provides the Phish Bait website and live previews, making the browser activity visible during the demonstration. Playwright navigates to the training page, fills its fields, and submits the form, while local request forwarding lets remotely hosted browsers reach the demo running on our laptop. A Next.js API and an in-memory store record submissions and supply dashboard status. Each component has a distinct responsibility: Claude creates the data, Playwright performs the actions, Steel hosts the browsers, and our app coordinates the workflow.

Challenges we ran into

One of the main challenges was keeping Steel’s cloud browser sessions, live previews, and our dashboard in sync. Steel hosted the browsers while Playwright performed the actions, so our app needed to connect each session to the correct fictional persona and submission status. We also had to distinguish preview connectivity from submission success, because a disconnected live preview does not necessarily mean the browser failed to submit the form. We verified results by matching each browser node with its server-side submission record, rather than relying on the live preview alone.

Accomplishments that we're proud of

We're proud of being able to emulate the real-world phishing process that shows both sides of the scam. By being able to view the delivery page that a potential victim sees and the scammer’s view, we can better understand how a deceptive form turns submitted information into collected records. Watching fictional personas complete that journey makes the process tangible and gives us a safe environment to explore whether synthetic records could make that data less useful, without exposing real personal information.

What we learned

We learned that browser automation needs multiple independent signals of success. A working Steel session or live preview only confirms that the browser is reachable, while a completed Playwright action confirms interaction, and a matching server-side record confirms that the form was actually submitted. Separating persona generation, browser execution, preview health, and submission verification made the system easier to debug and prevented the dashboard from reporting misleading results.

What's next for Phish Bait

Test out on real scam websites instead of cloned.

Built With

• anthropic
• claude
• css
• html
• javascript
• steel