Scotiabank Phishing Kit 76fc8cb

Detects a Bank of Nova Scotia (Scotiabank) phishing kit targeting Spanish speaking users. Commonly deployed on replit.com.

References

Recent Detections

None found yet

We've not seen any sites matching this indicator yet. Try scanning a site you think matches this rule:

IOK Rule (edit) 

title: Scotiabank Phishing Kit 76fc8cb
description: |
    Detects a Bank of Nova Scotia (Scotiabank) phishing kit targeting Spanish speaking users.
    Commonly deployed on `replit.com`.
    

references:
    - https://urlscan.io/result/76fc8cb5-bf41-454a-87da-35bef237e243/

detection:
    
    imageAssets:
        html|contains|all: 
            - 'im/logof.png'
            - 'im/logoa.png'
            - 'im/logog.png'
            - 'im/logob.png'
        
    exfilPhpScript:
        html|contains: 'action="step.php"'
        
    buttonID:
        html|contains: 'button id="submitx"'
        
    condition: imageAssets and exfilPhpScript and buttonID
    
tags:
  - target.scotiabank