Commbank phishing kit displaying a fake login

References

Recent Detections

hxxp://icommbank-log[.]in/

urlscan.io
hxxps://icommbank-log[.]in/

urlscan.io
hxxps://mycommbank-secure[.]support/

urlscan.io
hxxp://mycommbank-secure[.]support/netbank

urlscan.io
hxxps://mycommbank[.]me/

urlscan.io
hxxps://netbank[.]account-service[.]app/

urlscan.io
hxxps://commbank[.]account-security[.]app/

urlscan.io
hxxps://accounts[.]cba-online[.]com[.]au/

urlscan.io
hxxps://commbank[.]secured-access[.]com[.]au/

urlscan.io
hxxps://commbank[.]secure-accounts[.]com[.]au/

urlscan.io

IOK Rule (edit)

title: Commbank phishing kit displaying a fake login
description: |
  Commbank phishing kit displaying a fake login
references:
  - https://urlscan.io/result/49a46f7c-b531-417c-8110-b94942132039/
  - https://urlscan.io/result/605d7c8f-20dd-438d-8e2e-e4232bb067ef/
  - https://urlscan.io/result/d69bdec1-7377-466c-a1fd-44966dad8e0e/

detection:
  stylesheet:
    html|contains: '<link href="/secure/static/css/main.27d81c4d.chunk.css" rel="stylesheet">'
  scriptJs:
    html|contains: '<script src="/secure/static/js/3.b4db8f5a.chunk.js"></script>'
    
  condition: stylesheet and scriptJs

tags:
  - target.commbank