Microsoft Phishing Kit b3fcc7b

Detects a Microsoft phishing kit targeting Spanish speaking users.

References

Recent Detections

  • hxxps://informacionseguramsnoutlookautenticadorseguro[.]belivizc...
    urlscan.io
  • hxxps://solucioninstantaneareporte2220982caso[.]ninanj[.]repl[.]...
    urlscan.io
  • hxxps://iniciorw[.]outlksgds[.]repl[.]co/
    urlscan.io
  • hxxps://iniciofcsxz[.]outlksgsds[.]repl[.]co/
    urlscan.io
  • hxxps://verificardatos[.]reactived[.]repl[.]co/
    urlscan.io
  • hxxps://verificardatospersonales[.]datos2[.]repl[.]co/
    urlscan.io
  • hxxps://usuario[.]verificationn[.]repl[.]co/
    urlscan.io
  • hxxps://inicio[.]outlksgsv[.]repl[.]co/
    urlscan.io
  • hxxps://inicio[.]outlkscc[.]repl[.]co/
    urlscan.io
  • hxxps://outlookverificacion456798[.]victorelpro03[.]repl[.]co/
    urlscan.io

IOK Rule (edit) 

title: Microsoft Phishing Kit b3fcc7b
description: |
    Detects a Microsoft phishing kit targeting 
    Spanish speaking users.

references:
    - https://urlscan.io/result/b3fcc7b6-3193-418a-8a8c-0989d448fb94

detection:

    hiddenFormID:
      html|contains: 'idmedu129'

    formElementIDs:
      html|contains|all:
        - 'nm1'
        - 'nm2'
        - 'contenido1'

    condition: hiddenFormID and formElementIDs

tags:
  - kit
  - target.microsoft