· StalkPhish.io
Is that link phishing? Meet the StalkPhish URL scanner (closed beta)
Check a suspicious link without opening it: the StalkPhish URL scanner follows redirects and cloaking, and gives a phishing score with evidence. Closed beta.
Category
phishing
Analyses of phishing campaigns detected by StalkPhish: targeted brands, techniques, infrastructure and the actors behind them. 22 articles.All articles
· CSIRT
[StalkPhish.io] 8 Powerful Use Cases for the StalkPhish API in Anti-Fraud and Anti-Phishing Operations
Brand protection, SOC enrichment, threat hunting, Telegram exfiltration tracking: eight practical ways to use the StalkPhish API against phishing and fraud.
· CERT
[Phishing kit] MonCompteFormation 'Lead' phishing kit - an analysis
Analysis of the 'Lead' phishing kit impersonating MonCompteFormation (CPF), found in December 2024: pages, PHP scripts, logs and Telegram traces.
· cti
[Phishing] Current state of phishing threat using Paris 2024 Olympic games branding (June 24)
Phishing sites impersonating the Paris 2024 Olympic and Paralympic Games, spotted by StalkPhish.io in June 2024 to steal personal and banking data.
· CERT
Stalkphish.io - Launch of our Professional Plan
The StalkPhish.io Professional plan: 5,000 API requests a day, 6 months of history, and exclusive threat actor tracking and brand targeting.
· CERT
[Phishing kit] Caisse d'Epargne 'Don' phishing kit - an analysis
Analysis of the 'Don' phishing kit impersonating Caisse d'Epargne (BPCE group), downloaded by StalkPhish.io in December 2023: structure and configuration.
· CERT
[Threat intelligence] About the Phishing as a Service tool named "Greatness"
Short analysis of the Greatness phishing kit, a Phishing-as-a-Service tool targeting Microsoft 365 credentials and MFA, with original IOCs for hunting.
· investigation
[Phishing kit] Coinbase phishing kit with live admin panel to bypass MFA - an analysis.
Teardown of the HadySpeed Coinbase phishing kit: a live admin panel lets the scammer interact with victims in real time to steal their 2FA codes.
fr· CERT
Une campagne de phishing Netflix, Société Générale, Ameli ou Crit'air pour 10€
Plongée dans un réseau de « scama » francophone qui propose des campagnes de phishing clés en main à 10 € contre Netflix, Société Générale, Ameli ou Crit'Air.
· CERT
Stalkphish.io - Launch of our Standard Plan to better detect and fight phishing
Launch of the StalkPhish.io Standard plan: SSL/TLS certificate data, Google Safe Browsing status, phishing score and searches in page titles.
· CERT
[Use case] Hunting for phishing pages
Use case: detect phishing campaigns early by hunting phishing pages with StalkPhish, combining several data sources to find and take down sites faster.
· phishing
[Phishing kit] LinkedIn phishing kit targeting Chinese users - an analysis
A minimalist LinkedIn phishing kit written in Chinese: three PHP pages that email the stolen credentials, probably derived from a kit sold by Fudsender.
· CERT
[Threat intelligence] Using StalkPhish.io with Intel Owl to speed up threat analysis
How to use the StalkPhish.io analyzer in IntelOwl, the open source threat intelligence platform, to enrich observables and speed up phishing analysis.
· phishing
[Phishing kit] M&T Bank - Telegram exfiltration kit, without any Telegram link
An M&T Bank phishing kit that sends stolen data to Telegram without a single line of Telegram code, through an etlgr.com email-to-Telegram relay.
· phishing
[Phishing kit] 'Moha' kit, targeting DEWA suppliers
Analysis of the 'Moha' phishing kit targeting suppliers of the Dubai Electricity and Water Authority: a self-contained 1.2 MB kit that logs its visitors.
· phishing
Several domain names, one protected redirector, one phishing campaign
A DHL phishing campaign using several domain names and a captcha-protected web redirector to resist takedowns and hide its final phishing pages.
· phishing
[Use case] Using Phishing-Kit-Yara-Rules project for phishing kits detection and triage
How the PhishingKit-Yara-Rules project detects and sorts the phishing kit ZIP archives left on servers, to speed up triage and extract actor information.
· phishing
How-to use StalkPhish.io
Getting started with StalkPhish.io: create an account, get your API key and query enriched phishing and brand impersonation URLs through the REST API.
· phishing
[Phishing kit] Scammer vs Scammer - backdoored phishing kit
An XBalti phishing kit targeting Chase customers, hiding a backdoor that leaks the stolen data to someone else: when scammers rob each other.
· phishing
Phishing kit using Google sheet to exfiltrate stolen data
Analysis of a phishing kit targeting Vietnamese Facebook users, which sends the stolen credentials to an online Google Sheet with an AJAX POST request.
· phishing
How phishing kits uses Telegram
Teardown of a Crédit Agricole phishing kit that exfiltrates stolen data through a Telegram bot, and how the Telegram API reveals information about the actors.
· phishing
[Phishing Kit] 'Israel' Outlook Web App credentials stealer
Analysis of a phishing kit imitating an Outlook Web App login page, which tries to exfiltrate the stolen credentials through the FormBuddy online form service.