Twitter Phishing Kit 91a19aa

Detects a phishing kit developed by a Turkish actor targeting users of Twitter.

IOK Rule (edit)

title: Twitter Phishing Kit 91a19aa
description: |
    Detects a phishing kit developed by a Turkish actor
    targeting users of Twitter.

detection:
    pageFavicon:
      html|contains: 'https://www.imajkoruma.com/wp-content/uploads/2019/02/twitter.png'

    formDefinition:
      html|contains|all:
        - 'name="girisFormu"'
        - 'action="login.php"'

    condition: pageFavicon and formDefinition
   
tags:
  - kit
  - target.twitter