SocialFish is a modern dynamic phishing toolkit designed for credential harvesting, session hijacking, and social engineering attacks. It provides a Flask-based web application with an admin dashboard for managing cloned login pages, capturing credentials, intercepting OTP/2FA codes, tracking victim sessions, and injecting post-capture attack payloads (e.g., keyloggers, clipboard stealers, tab jacking). The system supports browser automation via Playwright and Selenium to clone JavaScript-heavy and SPA login flows, and includes tunneling via ngrok/cloudflared for exposing phishing URLs remotely. The architecture is a monolithic Flask app with SQLite storage, WebSocket real-time updates, and a mobile API authenticated by QR tokens. External dependencies include Flask, Flask-SocketIO, Flask-Login, Playwright, Selenium, nmap, qrcode, and PyLaTeX. Despite its feature-rich surface, the codebase exhibits significant quality issues: broken async flows, missing database columns, incomplete routes, version mismatches between requirements files, and security concerns such as default credentials and insecure secret key generation. The project is actively maintained (last commit 2026-05-20) but the code is not production-ready as claimed in documentation.