Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Suspected DPRK Phishing Campaign Targets Naver; Separate Apple Domain Spoofing Cluster Identified

hunt.io | blog | #phishing | #apple | #dprk | #tls-certificates | #domain-spoofing | #naver

Summary

Hunt.io finds an exposed Naver phishing server—change/cookie/login panels and 200+ hosted domains—plus a separate cluster spoofing Apple domains with distinctive TLS certificates.
Published
Collected

original ↗

Related coverage

blog · hunt.io
“Million OK!!!!” and the Naver Facade: Tracking Recent Suspected Kimsuky Infrastructure
Hunt.io traces new Kimsuky-suspected infrastructure reusing the distinctive 'Million OK!!!!' HTTP response and Naver branding, with domains on linked p-e.kr-style TLDs hosted in South Korea.
blog · hunt.io
A Practical Guide to Uncovering Malicious Infrastructure With Hunt.io
A step-by-step infrastructure hunting walkthrough: from an AsyncRAT-linked IP, pivoting through ASN data, ports, services and TLS certificates to uncover a wider cluster of systems.
blog · hunt.io
Announcing Hunt 2.5
Hunt 2.5 adds a Pivots table tying IPs to certificate subjects, hashes, and TLS fingerprints, 50+ certificate fields in HuntSQL, an Add to Query button, and a downloadable phishing feed.
blog · hunt.io
URLx Just Got Bigger: 10.6B URLs for Recon and Malicious Infrastructure Hunting
URLx expands to 10.6 billion URLs with richer SQL and domain-search filters; a walkthrough maps DPRK-linked compromised WordPress paths using API and SQL queries.
blog · hunt.io
LightSpy Malware Now Targets Facebook & Instagram Data
A newly seen LightSpy server shows an expanded command list targeting Facebook and Instagram database files, as Hunt tracks eight active servers via TLS certificates.
blog · hunt.io
Advanced Threat Hunting with New SSL Features: Unlocking HuntSQL™ Anomaly Flags for Deeper Detection
After PupyRAT slipped past its old parser, Hunt.io adopted Google's Certificate Transparency library and added HuntSQL anomaly flags for malformed, expired, and rogue certificates.
back