---
id: 6244
title: "Server-Side Phishing: How Credential Theft Campaigns Are Hiding in Plain Sight"
source_domain: hunt.io
source_url: "https://hunt.io/blog/server-side-phishing-evasion-employee-portals"
published_at: "2025-04-15T00:00:00Z"
tags: ["credential-theft", "phishing", "server-side", "evasion", "huntsql", "phishing-kit"]
phying_url: "https://phying.com/item/6244"
lang: en
---

# Server-Side Phishing: How Credential Theft Campaigns Are Hiding in Plain Sight

## Summary

A phishing campaign targeting employee and member portals now validates stolen credentials server-side to hinder analysis; found via HuntSQL crawler data, plus a healthcare-themed page.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2025-04-15T00:00:00Z
- **Original:** https://hunt.io/blog/server-side-phishing-evasion-employee-portals
- **Phying News:** https://phying.com/item/6244