Server-Side Phishing: How Credential Theft Campaigns Are Hiding in Plain Sight

Hunt found a W3LL phishing kit campaign using a fake Adobe Shared File page to steal Outlook credentials, covering its /OV6 panels, IonCube-obfuscated PHP and MFA-bypassing AitM techniques.

Describes how attackers can submit phishing domains to web content filter categorization services so corporate filters whitelist the sites, improving success rates in phishing engagements.

Part 4 of the Cobalt Strike series: automating the C2 feed via API—normalizing indicators into core, network and endpoint outputs for SIEM, IDS/EDR and sandbox pipelines.

Part 2 of the Cobalt Strike series: ten-plus HuntSQL recipes for detecting, grouping and tracking C2 infrastructure by certificate reuse, beacon traits and enrichment—from real hunting scenarios.

A beginner's guide to hunting exposed C2 panels—Supershell, HookBot, Chaos RAT, UnamWebPanel, Metasploit and Mythic—using URL paths, titles, favicon hashes and HuntSQL datasets.

Over 1,465 energy-sector phishing detections in a year: Chevron, ConocoPhillips, PBF and Phillips 66 cloned via HTTrack, blending credential theft with investment scams, and missed by most vendors.