en· CERT
[Phishing kit] MonCompteFormation 'Lead' phishing kit - an analysis
Analysis of the 'Lead' phishing kit impersonating MonCompteFormation (CPF), found in December 2024: pages, PHP scripts, logs and Telegram traces.
en· CERT
[Threat intelligence] About the Phishing as a Service tool named "Greatness"
Short analysis of the Greatness phishing kit, a Phishing-as-a-Service tool targeting Microsoft 365 credentials and MFA, with original IOCs for hunting.
en· investigation
[Phishing kit] Coinbase phishing kit with live admin panel to bypass MFA - an analysis.
Teardown of the HadySpeed Coinbase phishing kit: a live admin panel lets the scammer interact with victims in real time to steal their 2FA codes.
· CERT
Une campagne de phishing Netflix, Société Générale, Ameli ou Crit'air pour 10€
Plongée dans un réseau de « scama » francophone qui propose des campagnes de phishing clés en main à 10 € contre Netflix, Société Générale, Ameli ou Crit'Air.
en· CERT
[Use case] Hunting for phishing pages
Use case: detect phishing campaigns early by hunting phishing pages with StalkPhish, combining several data sources to find and take down sites faster.
en· CERT
[Threat intelligence] Using StalkPhish.io with Intel Owl to speed up threat analysis
How to use the StalkPhish.io analyzer in IntelOwl, the open source threat intelligence platform, to enrich observables and speed up phishing analysis.
en· phishing
[Phishing kit] M&T Bank - Telegram exfiltration kit, without any Telegram link
An M&T Bank phishing kit that sends stolen data to Telegram without a single line of Telegram code, through an etlgr.com email-to-Telegram relay.
en· phishing
[Phishing kit] 'Moha' kit, targeting DEWA suppliers
Analysis of the 'Moha' phishing kit targeting suppliers of the Dubai Electricity and Water Authority: a self-contained 1.2 MB kit that logs its visitors.
en· PhishingKit-Yara-Rules
Using PhishingKit-Yara-Rules with ClamAV
How to load the open source PhishingKit-Yara-Rules into ClamAV to detect phishing kit ZIP archives with an antivirus you already run.
en· phishing
Several domain names, one protected redirector, one phishing campaign
A DHL phishing campaign using several domain names and a captcha-protected web redirector to resist takedowns and hide its final phishing pages.
en· phishing
[Use case] Using Phishing-Kit-Yara-Rules project for phishing kits detection and triage
How the PhishingKit-Yara-Rules project detects and sorts the phishing kit ZIP archives left on servers, to speed up triage and extract actor information.
en· phishing
How-to use StalkPhish.io
Getting started with StalkPhish.io: create an account, get your API key and query enriched phishing and brand impersonation URLs through the REST API.
en· phishing
How phishing kits uses Telegram
Teardown of a Crédit Agricole phishing kit that exfiltrates stolen data through a Telegram bot, and how the Telegram API reveals information about the actors.