Itaú Unibanco Phishing Kit s8hx648o

IOK Rule (edit)

title: Itaú Unibanco Phishing Kit s8hx648o
description: |
    Detects a different Itaú Unibanco phishing kit.
    Discovered as a result of this being deployed on Replit.com.
    
references:
    - https://urlscan.io/result/d6c00c2d-d6be-4237-a9d1-2e10e481373b
    - https://urlscan.io/result/927b7a73-74df-4594-a431-e8da2cb741dd
    - https://urlscan.io/result/bce70e91-2337-429c-9aa2-0116d57b8004
    - https://urlscan.io/result/e37136c9-da08-453e-a5db-fe04e7e6952c
    - https://urlscan.io/result/f29ccced-6878-442c-873c-a9515d84a75b
    - https://urlscan.io/result/637e2572-b3d1-4e60-ae59-013b86fe0736
    - https://urlscan.io/result/6d24935b-bbb3-4e20-9317-31c83df5ef27
    - https://urlscan.io/result/c77d6c55-2ad1-4f75-8a74-b2e23f74a04f
    - https://www.itau.com/

detection:

    title:
      html|contains:
        - <title>Inicio</title>

    css:
      html|contains:
        - link href="ff/lgn.css" type="text/css" rel="stylesheet"

    form:
      html|contains:
        - form method="post" action="index1.php"  id="aspnetForm"

    inputs:
      html|contains|all:
        - input name="numdoc"
        - input name="pinacc"
        - input name="pintrac"

    placeholders:
      html|contains|all:
        - placeholder="n° de documento"
        - placeholder="Pin de acceso"
        - placeholder="Pin de Transacciones"

    logo:
      html|contains:
        - img src="ff/LOGO_ita.png" style="width:120px;"

    condition: all of them

tags:
  - kit
  - target.itau_unibanco
  - target_country.brazil