Microsoft Outlook Phishing Kit 9e75296

Recent Detections

• hxxps://giftedtreasuredeng[.]3r45f[.]repl[.]co/

  urlscan.io
• hxxps://mail-verify[.]segurityemail[.]repl[.]co/

  urlscan.io
• hxxps://mailaccountclient-com[.]verifyaccount01[.]repl[.]co/

  urlscan.io
• hxxps://mailaccountclient[.]verifyaccount01[.]repl[.]co/

  urlscan.io
• hxxps://uendjalpo[.]hdnal1[.]repl[.]co/

  urlscan.io
• hxxps://cuenta2323[.]confirmarsa[.]repl[.]co/

  urlscan.io
• hxxps://metallictruthfuladdresses[.]tabojo1461[.]repl[.]co/

  urlscan.io
• hxxp://buzonoutlook[.]eshost[.]com[.]ar/?i=2

  urlscan.io
• hxxp://buzonoutlook[.]eshost[.]com[.]ar/

  urlscan.io
• hxxps://athleticsnarlingrhombus32[.]sergio2525[.]repl[.]co/

  urlscan.io

IOK Rule (edit)

title: Microsoft Outlook Phishing Kit 9e75296
description: |
    Detects a Microsoft Outlook phishing kit targeting Spanish speaking users.
    
references:
    - https://urlscan.io/result/9e752962-a73a-41b6-813d-ca9026cb5391
    - https://urlscan.io/result/5c31c1c9-d13d-4ce6-a01b-b6c22e64e932
    
detection:

    jsFunction:
      html|contains: 'soloNumeros'
      
    logoFileName:
      html|contains: 'fond.png'
      
    exfilDestination:
      html|contains: 'action="savefile.php"'
      
    condition: jsFunction and logoFileName and exfilDestination

tags:
  - target.microsoft_outlook