Several domain names, one protected redirector, one phishing campaign

Sometimes phishing campaigns are not conduced with phishing kits only, actors behind those phishing campaigns can use different tricks to prevent their work being takedown, as using protected web redirectors. A campaign we can see this days use this redirector trick on several domain names. This campaign target DHL customers, impersonating the delivery company. A

Continue reading
No comments

Using Phishing-Kit-Yara-Rules project for phishing kits detection and triage

Since some months now, we maintain specific Yara rules to detect phishing kit sources (.zip files). Phishing kits sources are sometimes left on the host serving phishing pages. Using the StalkPhish project (see https://stalkphish.com/products/stalkphish/) we used to collect phishing kits in order to extract e-mails addresses, Telegram channels (see https://stalkphish.com/2020/12/14/how-phishing-kits-use-telegram/), and so on. In order

Continue reading