Patelco Phishing Kit 48ba653f

Patelco phishing kit which uses the same stylesheet and form error id across various domains.

References

IOK Rule (edit) 

title: Patelco Phishing Kit 48ba653f
description: |
    Patelco phishing kit which uses the same stylesheet and form error id across various domains.

references:
    - https://urlscan.io/result/48ba653f-645e-4348-9318-dc5811745ab1/
    - https://urlscan.io/result/235d32e0-8321-49e3-9437-1855bbd7e71b/
    - https://urlscan.io/result/726289c0-aa7a-4801-83d2-f4fd32cf7f80/

detection:

  stylesheet:
    html|contains: '<link rel="stylesheet" type="text/css" href="VisitorIdentificationCSS.aspx.css">'

  formError:
    html|contains: '<div class="form-error" id="B21AD518E4EF4F3DBCF943D0B6EDE8A3-error" tabindex="-1">Please'

  condition: stylesheet and formError

tags:
  - kit
  - target.patelco