Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Open Directory Exposes Phishing Campaign Targeting Google & Naver Credentials

hunt.io | blog | #phishing | #google | #north-korea | #kimsuky | #open-directories | #naver | #xeno-rat

Summary

Hunt tracked a likely North Korean campaign stealing Google and Naver credentials via iframes after its Binance spoof was flagged; an open directory also held Xeno-RAT and KakaoTalk logs.
Published
Collected

original ↗

Related coverage

blog · hunt.io
“Million OK!!!!” and the Naver Facade: Tracking Recent Suspected Kimsuky Infrastructure
Hunt.io traces new Kimsuky-suspected infrastructure reusing the distinctive 'Million OK!!!!' HTTP response and Naver branding, with domains on linked p-e.kr-style TLDs hosted in South Korea.
blog · hunt.io
Good Game, Gone Bad: Xeno RAT Spread Via .gg Domains and GitHub
Hunt found Xeno RAT C2 servers on .gg domains and a GitHub repo posing as Roblox tooling, tracing the open-source RAT's spread through gaming communities, with links to a North Korean group.
blog · hunt.io
The Complete Guide to Hunting Cobalt Strike – Part 1: Detecting in Open Directories
Part 1 of the Cobalt Strike series: using AttackCapture to mine open directories for PowerShell loaders and configs, then pivoting via SSL certificates and fingerprints to map live C2 servers.
blog · hunt.io
Uncovering Threat Actor Tactics: How Open Directories Provide Insight into XWorm Delivery Strategies
Using open directories, Hunt.io shows how XWorm RAT samples masquerade as browsers, security tools and file-transfer apps—including a lone SecurityHealthService.exe on a Thai-hosted server.
blog · hunt.io
RunningRAT’s Next Move: From Remote Access to Crypto mining For Profit
Hunt.io spots RunningRAT—previously an access and data-theft tool linked to 2018 Olympics campaigns—now staging crypto-mining payloads via open directories and a separate staging VPS.
blog · hunt.io
Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight
A Halloween-themed open directory on a Hong Kong host exposed Cobalt Strike 4.2, exploit code, the BrowserGhost tool and a Goblin phishing kit aimed at Chinese-speaking education platforms.
back