Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

One More Trip to The W3LL: Phishing Kit Targets Outlook Credentials

hunt.io | blog | #credential-theft | #aitm | #microsoft-365 | #phishing-kit | #w3ll | #outlook

Summary

Hunt found a W3LL phishing kit campaign using a fake Adobe Shared File page to steal Outlook credentials, covering its /OV6 panels, IonCube-obfuscated PHP and MFA-bypassing AitM techniques.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Server-Side Phishing: How Credential Theft Campaigns Are Hiding in Plain Sight
A phishing campaign targeting employee and member portals now validates stolen credentials server-side to hinder analysis; found via HuntSQL crawler data, plus a healthcare-themed page.
blog · hunt.io
Inside the 2025 Energy Phishing Wave: Chevron, Conoco, PBF, Phillips 66
Over 1,465 energy-sector phishing detections in a year: Chevron, ConocoPhillips, PBF and Phillips 66 cloned via HTTrack, blending credential theft with investment scams, and missed by most vendors.
blog · hunt.io
ERMAC V3.0 Banking Trojan: Full Source Code Leak and Infrastructure Analysis
Hunt.io obtained the full ERMAC V3.0 source code, exposing critical weaknesses like a hardcoded JWT secret and expanded form injection targeting 700+ financial and crypto apps.
blog · hunt.io
GreenSpot APT Targets NetEase 163.com Users with Fake Download Pages & Spoofed Domains
GreenSpot-linked infrastructure spoofs NetEase 163.com with a malicious login page and fake download pages on domains registered hours apart via a reseller, to steal credentials.
blog · hunt.io
Exposing Massive Phishing Scams Abusing Cloudflare Services
One shared Font Awesome kit helped Hunt.io uncover 60,000+ phishing links on Cloudflare Workers and IPFS gateways, mostly fake Microsoft SharePoint/Office365 logins plus DHL and webmail lures.
blog · hunt.io
Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight
A Halloween-themed open directory on a Hong Kong host exposed Cobalt Strike 4.2, exploit code, the BrowserGhost tool and a Goblin phishing kit aimed at Chinese-speaking education platforms.
back