Ficohsa Phishing Kit 39e336ff

Detects a phishing page that targets Honduran users of Ficohsa Bank.

This kit uses an old snapshot of the original website's stylesheet.

References

IOK Rule (edit) 

title: Ficohsa Phishing Kit 39e336ff
description: |
    Detects a phishing page that targets Honduran users
    of Ficohsa Bank.

    This kit uses an old snapshot of the original website's
    stylesheet.
   
references:
    - https://urlscan.io/result/39e336ff-781b-4633-bd06-d0e94977316c
    - https://urlscan.io/result/344c1b4e-15da-4872-bdff-8df0f1fd7b98

detection:

    imageFile:
        requests|contains: '13f6ebd6-3a21-4455-8ac2-f131aaf35295'

    styleSheet:
        requests|contains: 'styles.b1d6cdcc40a888de1051.bundle.css'

    condition: imageFile and styleSheet

tags:
    - target.ficohsa
    - target_country.honduras