Top Tweets for #KITIntel

Jake | JCyberSec_ @JCyberSec_

almost 2 years ago

A Philippines number sending USPS SMS Phishing 🇵🇭📲 🌐hxxp://uteyw.com/i/ 🔍#KITIntel - This kit uses a local API endpoint to exfil the data through a salted bade64 blob... The data is 'salted' locally in JS so you can just reverse it again 😂 #YouTried

JCyberSec_'s tweet photo. A Philippines number sending USPS SMS Phishing 🇵🇭📲

🌐hxxp://uteyw.com/i/

🔍#KITIntel - This kit uses a local API endpoint to exfil the data through a salted bade64 blob... The data is 'salted' locally in JS so you can just reverse it again 😂 #YouTried https://t.co/6WVRq80o7j

0

4

2

0

652

Jake | JCyberSec_ @JCyberSec_

about 3 years ago

🖥️Are you a URLScan Pro user? 📲Do you want to be alerted to the latest SMS phishing campaigns? ✅If so subscribe to a feed of IoCs which I have posted on Twitter - https://t.co/LNCohxvGdT #Phishing @urlscanio #KITIntel🔍

JCyberSec_'s tweet photo. 🖥️Are you a URLScan Pro user?
📲Do you want to be alerted to the latest SMS phishing campaigns?

✅If so subscribe to a feed of IoCs which I have posted on Twitter - https://t.co/LNCohxvGdT

#Phishing @urlscanio #KITIntel🔍 https://t.co/QQWwHSiX0j

0

7

4

1

3K

Jake | JCyberSec_ @JCyberSec_

about 3 years ago

This is interesting...⚠️ A malicious WhatsApp business account sending APK malware📲 🇮🇳Using ICICI Bank as the lure 🏦 #KITIntel🔍This is a poor effort in terms of spelling, grammar and forwarding of the message but an interesting TTP🤔 #Phishing #Malware

JCyberSec_'s tweet photo. This is interesting...⚠️

A malicious WhatsApp business account sending APK malware📲

🇮🇳Using ICICI Bank as the lure 🏦

#KITIntel🔍This is a poor effort in terms of spelling, grammar and forwarding of the message but an interesting TTP🤔

#Phishing #Malware https://t.co/IsalaGt8e7

3

13

4

3

3K

Jake | JCyberSec_ @JCyberSec_

about 3 years ago

Irish AIB SMS #phishing site 🏦 🌐hxxps://aib.info-40.com Geo-blocked to Irish IPs only 🇮🇪 #KITIntel🔍 #Phishing

JCyberSec_'s tweet photo. Irish AIB SMS #phishing site 🏦

🌐hxxps://aib.info-40.com

Geo-blocked to Irish IPs only 🇮🇪

#KITIntel🔍 #Phishing https://t.co/ZEANnRWNon

0

4

3

0

1K

Jake | JCyberSec_ @JCyberSec_

about 3 years ago

There is a growing trend of SMS📲 phishing targeting New Zealand using Toll Road payments as lures 🇳🇿🚗 Domains include: 🌐z.n-tollroads[.]top 🌐n.n-tollroads[.]xyz 🌐x.nz-tollroad[.]top 🌐n.nz-tollroad[.]icu 🌐tollroad-nz[.]top #ThreatIntel #KITIntel🔍 #CyberSecurity #Phishing

JCyberSec_'s tweet photo. There is a growing trend of SMS📲 phishing targeting New Zealand using Toll Road payments as lures 🇳🇿🚗

Domains include:
🌐z.n-tollroads[.]top
🌐n.n-tollroads[.]xyz
🌐x.nz-tollroad[.]top
🌐n.nz-tollroad[.]icu
🌐tollroad-nz[.]top

#ThreatIntel #KITIntel🔍 #CyberSecurity #Phishing https://t.co/5Dc9fOTt0g

JCyberSec_'s tweet photo. There is a growing trend of SMS📲 phishing targeting New Zealand using Toll Road payments as lures 🇳🇿🚗

Domains include:
🌐z.n-tollroads[.]top
🌐n.n-tollroads[.]xyz
🌐x.nz-tollroad[.]top
🌐n.nz-tollroad[.]icu
🌐tollroad-nz[.]top

#ThreatIntel #KITIntel🔍 #CyberSecurity #Phishing https://t.co/5Dc9fOTt0g

JCyberSec_'s tweet photo. There is a growing trend of SMS📲 phishing targeting New Zealand using Toll Road payments as lures 🇳🇿🚗

Domains include:
🌐z.n-tollroads[.]top
🌐n.n-tollroads[.]xyz
🌐x.nz-tollroad[.]top
🌐n.nz-tollroad[.]icu
🌐tollroad-nz[.]top

#ThreatIntel #KITIntel🔍 #CyberSecurity #Phishing https://t.co/5Dc9fOTt0g

1

5

4

0

1K

Jake | JCyberSec_ @JCyberSec_

over 3 years ago

Netflix #phishing SMS campaign using an auth header in the URL to trick users📺 👵This is a really old technique 🌐hxxp://www.netflix.com:911@s955471887 .onlinehome.us/mo #KITIntel🔍It works because HTTP authentication is optional and ignored by the server of the loaded site💻

JCyberSec_'s tweet photo. Netflix #phishing SMS campaign using an auth header in the URL to trick users📺

👵This is a really old technique

🌐hxxp://www.netflix.com:911@s955471887
.onlinehome.us/mo

#KITIntel🔍It works because HTTP authentication is optional and ignored by the server of the loaded site💻 https://t.co/IDkvnGDxG3

1

10

9

1

3K

Jake | JCyberSec_ @JCyberSec_

over 3 years ago

23 more of these sites have been stood up in the last few days📅 #⃣All domains on the same IP address: 156.232.9.170 🔍Notably a SMS linked to an Uber scam was sent but again to an unknown path...🚕 #Phishing #KITIntel🔍

JCyberSec_'s tweet photo. 23 more of these sites have been stood up in the last few days📅

#⃣All domains on the same IP address: 156.232.9.170

🔍Notably a SMS linked to an Uber scam was sent but again to an unknown path...🚕

#Phishing #KITIntel🔍 https://t.co/2H12bOvREc

JCyberSec_'s tweet photo. 23 more of these sites have been stood up in the last few days📅

#⃣All domains on the same IP address: 156.232.9.170

🔍Notably a SMS linked to an Uber scam was sent but again to an unknown path...🚕

#Phishing #KITIntel🔍 https://t.co/2H12bOvREc

JCyberSec_'s tweet photo. 23 more of these sites have been stood up in the last few days📅

#⃣All domains on the same IP address: 156.232.9.170

🔍Notably a SMS linked to an Uber scam was sent but again to an unknown path...🚕

#Phishing #KITIntel🔍 https://t.co/2H12bOvREc

JCyberSec_'s tweet photo. 23 more of these sites have been stood up in the last few days📅

#⃣All domains on the same IP address: 156.232.9.170

🔍Notably a SMS linked to an Uber scam was sent but again to an unknown path...🚕

#Phishing #KITIntel🔍 https://t.co/2H12bOvREc

Jake | JCyberSec_ @JCyberSec_

over 3 years ago

this is the most insane phishing SMS I have EVER seen... 🤯 🌐hxxps://insxes.bid/ This site just has a Test Login page... 🔍But under /opal1 there is a New South Wales #phishing site 🇦🇺

JCyberSec_'s tweet photo. this is the most insane phishing SMS I have EVER seen... 🤯

🌐hxxps://insxes.bid/

This site just has a Test Login page...

🔍But under /opal1 there is a New South Wales #phishing site 🇦🇺 https://t.co/EhZWF0i7oW

JCyberSec_'s tweet photo. this is the most insane phishing SMS I have EVER seen... 🤯

🌐hxxps://insxes.bid/

This site just has a Test Login page...

🔍But under /opal1 there is a New South Wales #phishing site 🇦🇺 https://t.co/EhZWF0i7oW

JCyberSec_'s tweet photo. this is the most insane phishing SMS I have EVER seen... 🤯

🌐hxxps://insxes.bid/

This site just has a Test Login page...

🔍But under /opal1 there is a New South Wales #phishing site 🇦🇺 https://t.co/EhZWF0i7oW

1

8

7

2

4K

0

4

3

0

1K

Jake | JCyberSec_ @JCyberSec_

over 3 years ago

In Total of all the domains I could find which were linked to this campaign I found 1,463 unique URLs across 22 domains. #KITIntel🔍

JCyberSec_'s tweet photo. In Total of all the domains I could find which were linked to this campaign I found 1,463 unique URLs across 22 domains.

#KITIntel🔍 https://t.co/XkUqhrWYw4

1

2

0

0

613

Jake | JCyberSec_ @JCyberSec_

over 3 years ago

Live Trezor SMS #phishing campaign🪙📱 1⃣🌐hxxps://dpsio.ink/ 2⃣🌐hxxps://exo-pro-support.click/ #KITIntel🔍 It appears to be an auto-drainer as it checks the seed phrase upon submission. If you put a real seed phrase automated withdrawals could occur⚠️

JCyberSec_'s tweet photo. Live Trezor SMS #phishing campaign🪙📱

1⃣🌐hxxps://dpsio.ink/
2⃣🌐hxxps://exo-pro-support.click/

#KITIntel🔍 It appears to be an auto-drainer as it checks the seed phrase upon submission. If you put a real seed phrase automated withdrawals could occur⚠️ https://t.co/IpDz9Z7yWh

JCyberSec_'s tweet photo. Live Trezor SMS #phishing campaign🪙📱

1⃣🌐hxxps://dpsio.ink/
2⃣🌐hxxps://exo-pro-support.click/

#KITIntel🔍 It appears to be an auto-drainer as it checks the seed phrase upon submission. If you put a real seed phrase automated withdrawals could occur⚠️ https://t.co/IpDz9Z7yWh

JCyberSec_'s tweet photo. Live Trezor SMS #phishing campaign🪙📱

1⃣🌐hxxps://dpsio.ink/
2⃣🌐hxxps://exo-pro-support.click/

#KITIntel🔍 It appears to be an auto-drainer as it checks the seed phrase upon submission. If you put a real seed phrase automated withdrawals could occur⚠️ https://t.co/IpDz9Z7yWh

JCyberSec_'s tweet photo. Live Trezor SMS #phishing campaign🪙📱

1⃣🌐hxxps://dpsio.ink/
2⃣🌐hxxps://exo-pro-support.click/

#KITIntel🔍 It appears to be an auto-drainer as it checks the seed phrase upon submission. If you put a real seed phrase automated withdrawals could occur⚠️ https://t.co/IpDz9Z7yWh

0

7

11

0

2K

Jake | JCyberSec_ @JCyberSec_

over 3 years ago

This is a screenshot from the last campaign the same actor ran📲 🌐hxxps://cu-accountverification.com #KITIntel🔍 The threat posed is great given all CUs are vulnerable as it uses the Irish League of Credit Unions as the page template

JCyberSec_'s tweet photo. This is a screenshot from the last campaign the same actor ran📲

🌐hxxps://cu-accountverification.com

#KITIntel🔍 The threat posed is great given all CUs are vulnerable as it uses the Irish League of Credit Unions as the page template https://t.co/pWeLmSUi9Y

1

1

2

0

803

Jake | JCyberSec_ @JCyberSec_

over 3 years ago

Indian HDFC Bank SMS #Phishing 🇮🇳🏦📱 1⃣🌐hxxps://rb.gy/bxdpoz 2⃣🌐hxxp://phpstack-946876-3295705.cloudwaysapps.com/ #KITIntel🔍 Kit also harvests OTP numbers after capturing the users mobile number 🔢

JCyberSec_'s tweet photo. Indian HDFC Bank SMS #Phishing 🇮🇳🏦📱

1⃣🌐hxxps://rb.gy/bxdpoz
2⃣🌐hxxp://phpstack-946876-3295705.cloudwaysapps.com/

#KITIntel🔍 Kit also harvests OTP numbers after capturing the users mobile number 🔢 https://t.co/h4oRZ9WSUK

JCyberSec_'s tweet photo. Indian HDFC Bank SMS #Phishing 🇮🇳🏦📱

1⃣🌐hxxps://rb.gy/bxdpoz
2⃣🌐hxxp://phpstack-946876-3295705.cloudwaysapps.com/

#KITIntel🔍 Kit also harvests OTP numbers after capturing the users mobile number 🔢 https://t.co/h4oRZ9WSUK

JCyberSec_'s tweet photo. Indian HDFC Bank SMS #Phishing 🇮🇳🏦📱

1⃣🌐hxxps://rb.gy/bxdpoz
2⃣🌐hxxp://phpstack-946876-3295705.cloudwaysapps.com/

#KITIntel🔍 Kit also harvests OTP numbers after capturing the users mobile number 🔢 https://t.co/h4oRZ9WSUK

1

2

3

2

838

Jake | JCyberSec_ @JCyberSec_

over 3 years ago

Another example of an AU Gov Phishing kit 🇦🇺🏦 🌐hxxps://atorefunding.line.pm/ret/MyGovATO ☎️+61480447518 All banks targeted are displayed in the image💰 #KITIntel🔍 This is a puppeteer/live #phishing site with a threat actor backend admin panel to monitor victims in real time

JCyberSec_'s tweet photo. Another example of an AU Gov Phishing kit 🇦🇺🏦

🌐hxxps://atorefunding.line.pm/ret/MyGovATO
☎️+61480447518

All banks targeted are displayed in the image💰

#KITIntel🔍 This is a puppeteer/live #phishing site with a threat actor backend admin panel to monitor victims in real time https://t.co/IHXeOJ6ob6

JCyberSec_'s tweet photo. Another example of an AU Gov Phishing kit 🇦🇺🏦

🌐hxxps://atorefunding.line.pm/ret/MyGovATO
☎️+61480447518

All banks targeted are displayed in the image💰

#KITIntel🔍 This is a puppeteer/live #phishing site with a threat actor backend admin panel to monitor victims in real time https://t.co/IHXeOJ6ob6

JCyberSec_'s tweet photo. Another example of an AU Gov Phishing kit 🇦🇺🏦

🌐hxxps://atorefunding.line.pm/ret/MyGovATO
☎️+61480447518

All banks targeted are displayed in the image💰

#KITIntel🔍 This is a puppeteer/live #phishing site with a threat actor backend admin panel to monitor victims in real time https://t.co/IHXeOJ6ob6

Jeremy Kirk @Jeremy_Kirk

over 3 years ago

There's some SMS phishing going around with the lure of a supposed tax refund from the @ato_gov_au. SMS link leads to fake MyGov page which then tries to capture bank login details. #infosec #Australia #cybersecurity

Jeremy_Kirk's tweet photo. There's some SMS phishing going around with the lure of a supposed tax refund from the @ato_gov_au. SMS link leads to fake MyGov page which then tries to capture bank login details. #infosec #Australia #cybersecurity https://t.co/XaBVgk0Ynj

Jeremy_Kirk's tweet photo. There's some SMS phishing going around with the lure of a supposed tax refund from the @ato_gov_au. SMS link leads to fake MyGov page which then tries to capture bank login details. #infosec #Australia #cybersecurity https://t.co/XaBVgk0Ynj

Jeremy_Kirk's tweet photo. There's some SMS phishing going around with the lure of a supposed tax refund from the @ato_gov_au. SMS link leads to fake MyGov page which then tries to capture bank login details. #infosec #Australia #cybersecurity https://t.co/XaBVgk0Ynj

5

52

35

2

15K

0

6

6

2

5K

Jake | JCyberSec_ @JCyberSec_

over 3 years ago

Live Commonwealth Bank SMS #phishing campaign🏦📱 🌐hxxps://cba-verify-ao.xyz/ #KITIntel🔍 Notice this SMS is sent using a spoofed CalledID meaning this SMS will be injected into the legitimate CommBank thread if present on the recipients phone 💉🇦🇺

JCyberSec_'s tweet photo. Live Commonwealth Bank SMS #phishing campaign🏦📱

🌐hxxps://cba-verify-ao.xyz/

#KITIntel🔍 Notice this SMS is sent using a spoofed CalledID meaning this SMS will be injected into the legitimate CommBank thread if present on the recipients phone 💉🇦🇺 https://t.co/d61jOc0zVG

0

3

2

0

821

Jake | JCyberSec_ @JCyberSec_

over 3 years ago

USPS Live #Phishing SMS campaign📦📱 1⃣🌐hxxps://tinyurl.com/US-PS-NBA 2⃣🌐hxxps://yhgnf.cyou/ ☎️+1 3344 984811 #KITIntel🔍 This campagin is geo-locked to the US and only allows mobile browsers 🇺🇸

JCyberSec_'s tweet photo. USPS Live #Phishing SMS campaign📦📱

1⃣🌐hxxps://tinyurl.com/US-PS-NBA
2⃣🌐hxxps://yhgnf.cyou/

☎️+1 3344 984811

#KITIntel🔍 This campagin is geo-locked to the US and only allows mobile browsers 🇺🇸 https://t.co/ONQxW26GFu

0

2

5

2

682

Jake | JCyberSec_ @JCyberSec_

over 3 years ago

Live Santander #Phishing SMS 🏦📱 🌐hxxps://activity-device-logon.com/Login.php ☎️+44 7751 763682 #KITIntel🔍 This is a old Kr3pto kit being re-used - These puppeteer kits have seen a major decline in the past 12 months with actors preferring a more passive phishing kit🥷✉️

JCyberSec_'s tweet photo. Live Santander #Phishing SMS 🏦📱

🌐hxxps://activity-device-logon.com/Login.php
☎️+44 7751 763682

#KITIntel🔍 This is a old Kr3pto kit being re-used - These puppeteer kits have seen a major decline in the past 12 months with actors preferring a more passive phishing kit🥷✉️ https://t.co/aOf07WsPYj

JCyberSec_'s tweet photo. Live Santander #Phishing SMS 🏦📱

🌐hxxps://activity-device-logon.com/Login.php
☎️+44 7751 763682

#KITIntel🔍 This is a old Kr3pto kit being re-used - These puppeteer kits have seen a major decline in the past 12 months with actors preferring a more passive phishing kit🥷✉️ https://t.co/aOf07WsPYj

JCyberSec_'s tweet photo. Live Santander #Phishing SMS 🏦📱

🌐hxxps://activity-device-logon.com/Login.php
☎️+44 7751 763682

#KITIntel🔍 This is a old Kr3pto kit being re-used - These puppeteer kits have seen a major decline in the past 12 months with actors preferring a more passive phishing kit🥷✉️ https://t.co/aOf07WsPYj

1

6

4

1

2K

Jake | JCyberSec_ @JCyberSec_

over 3 years ago

Hey Bank of Ireland 🏦🇮🇪 you ok hun? #phishing #scam #CyberSecurityAwareness #KITIntel🔎

JCyberSec_'s tweet photo. Hey Bank of Ireland 🏦🇮🇪

you ok hun?

#phishing #scam #CyberSecurityAwareness #KITIntel🔎 https://t.co/EkxNTbILhF

3

3

2

0

2K

Jake | JCyberSec_ @JCyberSec_

over 3 years ago

About to process all these...🔍 📅Interesting campaigns will be post throughout the day So keep an eye on my feed👀 #Phishing #KITIntel🔎

JCyberSec_'s tweet photo. About to process all these...🔍

📅Interesting campaigns will be post throughout the day

So keep an eye on my feed👀

#Phishing
#KITIntel🔎 https://t.co/Hdv1CySoHl

0

2

0

0

391

Jake | JCyberSec_ @JCyberSec_

over 3 years ago

Whilst talking Santander... Here is a live phishing site🏦 🌐hxxps://onlinebanking-device-access.com/Login.php 💢@NiceNIC_NET #KITIntel🔍This is a #kr3pto kit but it has been cracked by another actor and re-distributed🥷 📁Kitname: Sants%20Newest%20Panel #PhishingKit #Intel

JCyberSec_'s tweet photo. Whilst talking Santander... Here is a live phishing site🏦

🌐hxxps://onlinebanking-device-access.com/Login.php
💢@NiceNIC_NET

#KITIntel🔍This is a #kr3pto kit but it has been cracked by another actor and re-distributed🥷

📁Kitname: Sants%20Newest%20Panel

#PhishingKit #Intel https://t.co/hGzhhIZIt3

JCyberSec_'s tweet photo. Whilst talking Santander... Here is a live phishing site🏦

🌐hxxps://onlinebanking-device-access.com/Login.php
💢@NiceNIC_NET

#KITIntel🔍This is a #kr3pto kit but it has been cracked by another actor and re-distributed🥷

📁Kitname: Sants%20Newest%20Panel

#PhishingKit #Intel https://t.co/hGzhhIZIt3

JCyberSec_'s tweet photo. Whilst talking Santander... Here is a live phishing site🏦

🌐hxxps://onlinebanking-device-access.com/Login.php
💢@NiceNIC_NET

#KITIntel🔍This is a #kr3pto kit but it has been cracked by another actor and re-distributed🥷

📁Kitname: Sants%20Newest%20Panel

#PhishingKit #Intel https://t.co/hGzhhIZIt3

Jake | JCyberSec_ @JCyberSec_

over 3 years ago

Santander call back scam currently active☎️ 🔢Scam number is 0300 220 4418 📈These campaigns are on the rise and linked to malicious call centres globally🌐

JCyberSec_'s tweet photo. Santander call back scam currently active☎️

🔢Scam number is 0300 220 4418

📈These campaigns are on the rise and linked to malicious call centres globally🌐 https://t.co/3FxKfmm6ZK

1

10

5

0

0

1

4

5

0

0

Jake | JCyberSec_ @JCyberSec_

over 3 years ago

#KITIntel🔍 users can search for MRWEEBEE kits by looking at the content fields in result files. A sample kit can be found at kit.UUID:d6091cc3-3f30-4e02-9d10-eb445287542f

1

1

0

0

0

Jake | JCyberSec_ @JCyberSec_

over 3 years ago

@neonprimetime @tosscoinwitcher @James_inthe_box @nullcookies #KITIntel🔍 rocks - I just use the data!

0

2

0

0

0

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users