· CERT
[StalkPhish.io] Phishing Kit family enrichment
StalkPhish.io now classifies the phishing kits it collects by family, using the open source PhishingKit-Yara-Rules, to speed up qualification and investigation.
Category
PhishingKit-Yara-Rules
Our open source YARA rules for phishing kits: detection, triage, integrations and analyses of the kits they identify. 11 articles.All articles
· CERT
[Phishing kit] Caisse d'Epargne 'Don' phishing kit - an analysis
Analysis of the 'Don' phishing kit impersonating Caisse d'Epargne (BPCE group), downloaded by StalkPhish.io in December 2023: structure and configuration.
· CERT
[Threat intelligence] About the Phishing as a Service tool named "Greatness"
Short analysis of the Greatness phishing kit, a Phishing-as-a-Service tool targeting Microsoft 365 credentials and MFA, with original IOCs for hunting.
· investigation
[Phishing kit] Coinbase phishing kit with live admin panel to bypass MFA - an analysis.
Teardown of the HadySpeed Coinbase phishing kit: a live admin panel lets the scammer interact with victims in real time to steal their 2FA codes.
· CERT
[Use case] Hunting for phishing pages
Use case: detect phishing campaigns early by hunting phishing pages with StalkPhish, combining several data sources to find and take down sites faster.
· phishing
[Phishing kit] LinkedIn phishing kit targeting Chinese users - an analysis
A minimalist LinkedIn phishing kit written in Chinese: three PHP pages that email the stolen credentials, probably derived from a kit sold by Fudsender.
· phishing
[Phishing kit] M&T Bank - Telegram exfiltration kit, without any Telegram link
An M&T Bank phishing kit that sends stolen data to Telegram without a single line of Telegram code, through an etlgr.com email-to-Telegram relay.
· phishing
[Phishing kit] 'Moha' kit, targeting DEWA suppliers
Analysis of the 'Moha' phishing kit targeting suppliers of the Dubai Electricity and Water Authority: a self-contained 1.2 MB kit that logs its visitors.
· PhishingKit-Yara-Rules
Using PhishingKit-Yara-Rules with ClamAV
How to load the open source PhishingKit-Yara-Rules into ClamAV to detect phishing kit ZIP archives with an antivirus you already run.
· phishing
[Use case] Using Phishing-Kit-Yara-Rules project for phishing kits detection and triage
How the PhishingKit-Yara-Rules project detects and sorts the phishing kit ZIP archives left on servers, to speed up triage and extract actor information.
· phishing
Phishing kit using Google sheet to exfiltrate stolen data
Analysis of a phishing kit targeting Vietnamese Facebook users, which sends the stolen credentials to an online Google Sheet with an AJAX POST request.