PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Unmasking Phishing: Strategies for identifying 0ktapus domains and beyond

wiz.io | research | #cloud | #phishing | #social-engineering | #scattered-spider | #identity | #threat-research | #0ktapus
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz Research shares techniques for tracing phishing infrastructure by pivoting across landing pages, using 0ktapus (Scattered Spider) as a case study to surface current and future campaigns.
Published
Collected

Related coverage

research · volexity.com
Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks
# Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks December 4, 2025 Matthew Meltzer, Steven Adair, and Tom Lancaster In early 2025, Volexity...
blog · wiz.io
From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage
How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage
blog · wiz.io
AWS Console Session Traceability: How Attackers Obfuscate Identity Through the AWS Console
Wiz researchers detail Console Conceal: a technique that abuses default AWS setups without SourceIdentity to obfuscate who performed console actions in CloudTrail, plus mitigations and investigation steps.
blog · netspi.com
Adding Web Content Filter Exceptions for Phishing Success
Describes how attackers can submit phishing domains to web content filter categorization services so corporate filters whitelist the sites, improving success rates in phishing engagements.
blog · netspi.com
All You Need Is One – A ClickOnce Love Story
ClickOnce deployment, built for easy Windows app installs, doubles as a phishing vector: one click can grant a malicious payload temporary admin privileges, controlled by registry trust settings.
blog · netspi.com
Malicious MobileConfigs
A phishing email delivering a .mobileconfig profile can reroute iOS devices through an attacker proxy, install malicious MDM, and capture HTTP/HTTPS traffic or domain credentials via Burp.
Back