NordPass Phishing Kit 79fa7dc3

NordPass Phishing Kit that uses a fake login page to steal user credentials.

References

IOK Rule (edit) 

title: NordPass Phishing Kit 79fa7dc3
description: |
  NordPass Phishing Kit that uses a fake login page to steal user credentials.

references:
  - https://urlscan.io/result/d8fe8ce3-54f0-419e-9df0-3f3df7f82eb8/
  - https://urlscan.io/result/79fa7dc3-ccf6-42a3-838e-2b171915003c/

detection:

  cssStyles:
    html|contains|all: 
      - '<style data-savepage-href="/src/main.23803042b1e928f05f39.css">'
      - '<style data-savepage-href="/src/781.ed027aed3800aad4c7c0.css" type="text/css">'

  condition: cssStyles

tags:
  - kit
  - target.nordpass