[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8ODY8Gmr9qGnhRpKenbBNUR1JZU-Axxm-7IkzN23-PI":3},{"article":4,"iocs":36,"watch_terms":44,"solutions":45,"lesson":130},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"3b427ccb-225c-4e39-93c7-206d7b91641f","Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia","wazza-phishkit-targets-banking-government-and-manufacturing-across-the-us-eu-and-e8a1c9","Phishing kits are no longer limited to copying a familiar login page and waiting for a victim to enter credentials. Attackers are increasingly building filtering, session management, and traffic controls into the infrastructure that delivers the phishing page itself. ANY.RUN has identified Wazza, a new phishkit targeting banking, manufacturing, and government organizations across the US, Europe","A new phishing kit named Wazza has been identified, employing a multi-stage routing infrastructure to screen visitors and automated traffic before delivering its payload. This sophisticated approach makes initial detection more challenging for security teams. Wazza targets critical sectors like banking, government, and manufacturing across the US, EU, and Australia, utilizing an Adobe-themed Device Code phishing page to harvest credentials.","Wazza phishkit uses multi-stage routing to target banking, government, and manufacturing sectors in US, EU, and","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fwazza-phishkit-targets-banking.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjnlTrJzuyuM3FgdyTkx-JLieOXeR9fK_hENZFrdItZ09E4ZFhk8UYOPslpbGGidTUGCDgcTHqY7wvYrThg-Hwl24MQhL63GIfmRsBLy9MJ7iDXn1XbbX1W_EgGFw9eRyT4LOJq0aoyWhmOHF3O5a9L5LcKNS1IJxQqs_UBwmOnPRmx3fXwUPpKeYdARVE\u002Fs1600\u002Fanyrun.jpg","2026-10-08T10:30:00+00:00","2026-10-08T12:00:21.909506+00:00",8,[17,20],{"name":18,"type":19},"Device Code","product",{"name":21,"type":22},"Phishing","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":23,"icon":25,"name":26,"slug":27},null,"Threat Intelligence","threat-intelligence",[29,34],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},[37,41],{"type":38,"value":39,"context":40},"domain","boegl-krysl.eu","Wildcard landing domain and validation gate for Wazza phishkit.",{"type":38,"value":42,"context":43},"beacon-surge-sync.workers.dev","Infrastructure used by Wazza to issue client markers.",[18],{"controls":46,"vendors":129},[47,76,102],{"slug":48,"name":49,"problem":50,"products":51},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":77,"name":78,"problem":79,"products":80},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":98,"product_name":99,"url":100,"description":101},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"slug":103,"name":104,"problem":105,"products":106},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[107,115,122],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":116,"product_name":119,"url":120,"description":121},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":103,"product_name":126,"url":127,"description":128},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":131,"title":132,"body":133,"framework_refs":134,"framework_notes":147},"wazza-phishing-kit-bypasses-detection-to-harvest-credentials-across-critical-sectors","Wazza Phishing Kit Bypasses Detection to Harvest Credentials Across Critical Sectors","The Wazza phishing kit represents a significant evolution in credential harvesting attacks, using multi-stage routing infrastructure to filter out security scanners and automated traffic before delivering its malicious Adobe-themed Device Code phishing payload. By impersonating a trusted brand like Adobe and targeting high-value sectors — banking, government, and manufacturing — attackers maximize the likelihood of capturing privileged credentials. The Device Code flow abuse is particularly dangerous because it can bypass multi-factor authentication by tricking users into authorizing attacker-controlled sessions. This matters because compromised credentials in these sectors can lead to large-scale data breaches, regulatory violations, and disruption of critical infrastructure.",[135,136,137,138,139,140,141,142,143,144,145,146],"CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 16 – Application Software Security","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant MFA)","NIST AC-17 – Remote Access Controls","NIST SI-3 – Malicious Code Protection","NIST IR-4 – Incident Handling","MITRE ATT&CK T1566 – Phishing","MITRE ATT&CK T1528 – Steal Application Access Token (Device Code Flow)","GDPR Article 32 – Security of Processing","NIST CSF DE.CM-1 – Network Monitoring","ITIL – Continual Service Improvement (Security Training Cadence)",{}]