Topic
Prebuilt toolkits mimicking login, update or verification pages to trick victims into revealing credentials, tokens or payment data for theft.
ANY.RUN says the Wazza phishkit routes visitors through a multi-stage filtering chain before serving an Adobe-themed device-code phishing page. The chain screens out automated traffic, so the first link gives banking, government and manufacturing defenders little to analyze.
Reality
Malwarebytes found 70 sites cloning Kraken's xStocks, Pendle and other crypto projects to push a fake rewards vote that opens a wallet prompt. The targets, it says, are projects whose users are used to hearing about rewards and allocations.
Reality
The OAuth device authorization grant was built for smart TVs and printers. Kits such as EvilTokens use it to get victims to approve an attacker's sign-in on a page that really is Microsoft's, MFA included.
Reality
eSentire says a phishing kit called GhostCode used Microsoft's device-code flow to register three devices within 77 seconds of a victim completing MFA, and one of them stayed enrolled in Intune until it was explicitly removed.
Reality
ANY.RUN says the kit lures staff with Teams, DocuSign and Dropbox pages, walks them through a genuine device code sign-in, and then takes the access and refresh tokens to register a device of its own.
Reality
A Talos walkthrough treats runtime deobfuscation as ordinary triage work. It also offers no prevalence number, which leaves defenders to size the blind spot themselves.
Reality