Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia

Summary: ANY.RUN identified a new phishkit called Wazza targeting banking, manufacturing, and government organizations across the US, Europe, and Australia, using a multi-stage routing chain to screen visitors before serving an Adobe-themed Device Code phishing page. The flow runs from a wildcard landing domain through a config endpoint, a client marker from a workers.dev host, a short-lived signed session token, and token and browser telemetry validation before the visitor reaches the final lure.
What you should know: A suspicious URL can appear benign because automated systems and human visitors may receive different content, so an analyst who cannot reproduce the full routing sequence may have to escalate just to learn what the link delivers. Blocking one Wazza domain does not end the campaign, since domains can be replaced and routing logic modified as attackers adapt to detection.

Read the original at The Hacker News ↗