A friend of mine got phished and I did a teardown of the infrastructure components that were used to execute the attack, that executes a Browser-In-The-Middle attack with an encrypted websocket. I've already reached out to the involved infrastructure providers, but haven't yet heard back from all of them yet.