Credential harvesting phishing emails are the scourge of inboxes everywhere. While these emails are meant to steal account information, sometimes attackers leave behind copies of their source code which we can analyze. This allows us to better understand the attacker and what they are doing exactly. This talk will highlight the collection of these phish kits, analysis of them as well as automating this process.