S-Pankki Phishing Kit d612de8e

S-Pankki phishing kit which uses the same hidden value across various domains.

References

IOK Rule (edit) 

title: S-Pankki Phishing Kit d612de8e
description: |
    S-Pankki phishing kit which uses the same hidden value across various domains.

references:
    - https://urlscan.io/result/f78a4aff-c3c6-45e4-a37e-db5808a8fb31/
    - https://urlscan.io/result/d612de8e-2c65-4c93-96b1-f2975d66fa2c/
    - https://urlscan.io/result/383931f0-0ccf-49b6-9703-d82d2745c3a1/

detection:

    qrId:
      html|contains: <input type="hidden" name="qrId" id="qrId" value="NETBANKE445349A3B4F6B10E01A162C5">

    condition: qrId

tags:
  - kit
  - target.spankki