Ark Investment Crypto Phishing Kit 3465f6c

Detects a crypto phishing kit using Ark Investment as proof of the giveaway being legitmate, this kit also uses people like Elon Musk to lure victims.

References

Recent Detections

hxxp://ark-lives[.]com/

urlscan.io
hxxps://ark-prize[.]com/

urlscan.io

IOK Rule (edit)

title: Ark Investment Crypto Phishing Kit 3465f6c
description: |
    Detects a crypto phishing kit using Ark Investment 
    as proof of the giveaway being legitmate, this kit 
    also uses people like Elon Musk to lure victims.

references:
  - https://urlscan.io/result/3465f6c7-429f-4ad6-9fa3-a3a43787e36a
  - https://urlscan.io/result/d96e74a6-88a4-432b-9b22-04134ab1fac1

detection:

  hiddenInputs: 
    html|contains|all:
      - 'input type="hidden" name="address_eth"'
      - 'input type="hidden" name="address_btc"'

  pageTitle:
    html|contains: 'Biggest giveaway Ark Invest of'

  condition: pageTitle and hiddenInputs

tags:
  - kit
  - target.arkinvestment
  - cryptocurrency
  - cryptocurrency.bitcoin
  - cryptocurrency.ethereum