Tag
5 articles covering Phishing Kits across campaign analysis, detection engineering, and defender tradecraft.
Field Analysis
Reverse-proxy phishing kits commoditized session-token theft over the last two years. The kit market now resembles SaaS, and that has implications for how defenders track operators.
Read more:Microsoft Threat IntelligenceSekoia
Field Analysis
A June 2026 wave of AWS console phishing sites relayed sign-in and MFA to the real AWS in real time, capturing session material from a curated list of engineers. AiTM has moved past Microsoft identity, and the detection has to move with it.
Read more:Datadog Security LabsNVISO Labs
Field Analysis
Storm-1747 sells Tycoon 2FA - one of the most prolific reverse-proxy phishing kits in current circulation. This brief is what a defender team needs to know about the operator class.
Read more:Microsoft Threat IntelligenceSekoia
Field Analysis
A newly reported kit packages templates, domain setup, anti-analysis controls, session monitoring, and AI-assisted drafting into one operator console.
Read more:BleepingComputerVaronis
Field Analysis
SVG attachments became one of 2024 and 2025's fastest-growing phishing payload formats. The reason isn't novelty - it is that SVG sits in a parsing gap most secure email gateways inherit.
Read more:Sophos NewsCisco Talos