BBVA Phishing Kit k3dums5h

Detects a BBVA (Banco Bilbao Vizcaya Argentaria) phishing kit deployed often on replit.com.

References

IOK Rule (edit) 

title: BBVA Phishing Kit k3dums5h
description: |
    Detects a BBVA (Banco Bilbao Vizcaya Argentaria) phishing kit deployed often on replit.com.

references:
    - https://urlscan.io/result/3c8844ef-1b1e-4122-a0ee-fb0834400b32

detection:

    title:
      html|contains:
        - <title>Inicio</title>

    css:
      html|contains:
        - href="./fhs/style_crown.css"

    form:
      html|contains|all:
        - form method="POST" action="index2.php"
        - onkeypress="soloNumeros(event)"

    inputs:
      html|contains|all:
        - input name="numdoc"  type="tel"
        - input type="password" name="clvs"

    condition: title and css and form and inputs

tags:
  - kit
  - target.bbva
  - target_country.argentina