Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

EvilGophish Unhooked: Insights into the Infrastructure and Notable Domains

hunt.io | blog | #phishing | #infrastructure | #gophish | #evilgophish | #cloudflare-turnstile | #evilginx

Summary

Hunt.io unwraps EvilGophish—an open-source kit fusing Evilginx3 with GoPhish—detailing its Cloudflare Turnstile abuse, admin-panel signatures and the lookalike domains it spawns for phishing.
Published
Collected

original ↗

Related coverage

blog · hunt.io
GoPhish Infrastructure Targets Polish Energy and Government
An exposed GoPhish admin panel on a Microsoft-hosted IP served domains spoofing Poland's energy regulator and a renewable energy firm, staged for sector-specific credential collection.
blog · hunt.io
SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia
Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.
blog · hunt.io
Shared SSH Keys Expose Phishing Infrastructure Targeting Kuwait
An ongoing campaign staging 100+ domains on Aeza servers, linked by reused SSH keys and shared ASN, phishes Kuwaiti fisheries, telecom, and insurance organizations via cloned portals.
blog · hunt.io
APT34-Like Threat Infrastructure Uncovered Before Activation
Dormant APT34-like infrastructure impersonating an Iraqi academic institute and fake UK tech firms reused SSH keys and port 8080 decoy 404s on M247 servers, offering early warning.
blog · hunt.io
JSPSpy and ‘Filebroser’: A Custom File Management Tool in Webshell Infrastructure
Four JSPSpy webshell servers across China and the US also host 'Filebroser', a rebranded File Browser panel likely repurposed for covert file management on compromised hosts.
blog · hunt.io
“Million OK!!!!” and the Naver Facade: Tracking Recent Suspected Kimsuky Infrastructure
Hunt.io traces new Kimsuky-suspected infrastructure reusing the distinctive 'Million OK!!!!' HTTP response and Naver branding, with domains on linked p-e.kr-style TLDs hosted in South Korea.
back