GoPhish Infrastructure Targets Polish Energy and Government

Hunt.io unwraps EvilGophish—an open-source kit fusing Evilginx3 with GoPhish—detailing its Cloudflare Turnstile abuse, admin-panel signatures and the lookalike domains it spawns for phishing.

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

Hunt.io traces a coordinated smishing operation across 19 countries: 1,628 malicious URLs and 32 backend IPs targeting government, postal and telecom services on three continents.

Hunt.io correlates 28 multilingual phishing pages—Chinese, English and Japanese—sharing ZIP lures and download.php backend logic, targeting financial and government organizations across Asia.

Over 1,465 energy-sector phishing detections in a year: Chevron, ConocoPhillips, PBF and Phillips 66 cloned via HTTrack, blending credential theft with investment scams, and missed by most vendors.

An ongoing campaign staging 100+ domains on Aeza servers, linked by reused SSH keys and shared ASN, phishes Kuwaiti fisheries, telecom, and insurance organizations via cloned portals.