Phishing Kit Shifts Credential and OTP Validation Server-Side to Evade Analysis
Summary
Researchers identified phishing pages impersonating employee and member portals that steal credentials and OTPs. The PHP-based kit uses server-side validation, while related domains and hosting infrastructure provide indicators for defenders to investigate.
Key points
- Cloned portals impersonating Aramark, Oregon's Frances Online, Highmark, and other organizations send credentials to a PHP script, xxx.php.
- A newer kit polls check.php for server-side credential validation, obscuring redirect and validation behavior from client-side analysis.
- A Highmark impersonation simulates a 2FA flow, collecting OTPs through POST requests marked with type=3.
- Researchers identified 12 phishing domains hosted at 80.64.30[.]101 and related portal domains at adjacent IP 80.64.30[.]100.
- Defenders are advised to investigate suspicious POSTs to xxx.php or check.php, type=3 parameters, cloned login pages, and related certificate and infrastructure indicators.
Article Details
- Attack Vectors
- Cloned employee and member login portals collect usernames and passwords through a PHP-based phishing kit.
- Some pages capture credentials through POST requests to xxx.php and use server-side polling of check.php to validate submissions.
- A variant impersonating Highmark simulates a two-factor authentication flow and collects OTPs through type=3 POST requests.
- Defensive Notes
- Flag POST requests to suspicious PHP scripts such as xxx.php and check.php, especially on domains mimicking enterprise login portals.
- Look for type=3 in request bodies and redirects following successful credential or OTP submission.
- Review traffic to IP-hosted login pages and pages using paths such as /online.
- Investigate certificates using IP addresses as common names, issuer values such as O=XX, or unexpected ports such as 993 and 995.
- Monitor infrastructure associated with Chang Way Technologies when it is combined with cloned login pages, decoy content, or reused phishing templates.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | afilachokloginochok[.]com | Domain listed as hosted on phishing infrastructure at 80.64.30[.]101. |
| DOMAIN | afiocksignoned[.]com | Domain listed as hosted on phishing infrastructure at 80.64.30[.]101. |
| DOMAIN | attdomhomepage[.]com | Domain listed among sites spoofing corporate login portals on phishing infrastructure at 80.64.30[.]101. |
| DOMAIN | charterssonidp[.]com | Domain included in the article's IOC table under the phishing infrastructure observables. |
| DOMAIN | empnohourstodayhr[.]com | Domain listed as hosted on phishing infrastructure at 80.64.30[.]101. |
| DOMAIN | eservicesa[.]live | Domain listed as hosted on phishing infrastructure at 80.64.30[.]100. |
| DOMAIN | flyungtogether[.]com | Domain listed as hosted on phishing infrastructure at 80.64.30[.]100. |
| DOMAIN | forurbestexper[.]com | Phishing domain impersonating Frances Online and hosted at 80.64.30[.]101. |
| DOMAIN | franchehub[.]us | Domain listed as hosted on phishing infrastructure at 80.64.30[.]100. |
| DOMAIN | hignmarkedmemb[.]com | Phishing domain impersonating Highmark and hosted at 80.64.30[.]101. |
| DOMAIN | ipafranchest[.]com | Domain listed as hosted on phishing infrastructure at 80.64.30[.]100. |
| DOMAIN | lawpaymentpw[.]live | Domain listed as hosted on phishing infrastructure at 80.64.30[.]100. |
| DOMAIN | middafitich[.]com | Domain listed as hosted on phishing infrastructure at 80.64.30[.]100. |
| DOMAIN | myinfoaramapay[.]com | Phishing domain impersonating Aramark's MyAccess login portal. |
| DOMAIN | myportalbsbsist[.]com | Domain listed as hosted on phishing infrastructure at 80.64.30[.]100. |
| DOMAIN | www[.]adaptchm[.]com | Domain listed as hosted on phishing infrastructure at 80.64.30[.]101. |
| DOMAIN | www[.]franceuisonl[.]com | Domain listed as hosted on phishing infrastructure at 80.64.30[.]101. |
| IPV4 | 80[.]64[.]30[.]100 | Phishing infrastructure hosting cloned employee login portals. |
| IPV4 | 80[.]64[.]30[.]101 | Phishing infrastructure hosting cloned employee and member login portals. |
MITRE ATT&CK
CVE
Malware
Hydrais a Hong Kong-registered ASN previously linked to Android and Windows malware distribution (e.g., Hydra, SectopRAT), Citrix Netscaler exploitation (CVE-2023-3519), and phishing targeting financial andSectopRATa Hong Kong-registered ASN previously linked to Android and Windows malware distribution (e.g., Hydra, SectopRAT), Citrix Netscaler exploitation (CVE-2023-3519), and phishing targeting financial and governmentShadowPadand evolve their operational footprint. From Gamaredon's flux-like DNS activity to the reuse of ShadowPad-linked certificates and staging scripts, each cluster provides a window into how adversaries prepare
Vendors
Products
Frances Onlineforurbestexper[.]com-hosts a page impersonating Frances Online, the Oregon Employment Department's unemployment claim portal.MyAccessmyinfoaramapay[.]com-a domain impersonating Aramark's MyAccess login portal. This page, and others uncovered in the dataset, share common themes and technical traits that will be detailed in the next section.
Tools
Countries
Hong KongChang Way Technologies Co. Limited (AS57523) is a Hong Kong-registered ASN previously linked to Android and Windows malware distribution (e.g., Hydra, SectopRAT), Citrix Netscaler exploitation (CVE-2023-3519), andRussia80.64.30[.]101, operated by Chang Way Technologies Co. Limited, in Russia. This server hosts multiple similarly structured domains serving phishing pages that target login portals. We'll expand on these domains in theUnited States
Industries
Financial ServicesGovernmentHydra, SectopRAT), Citrix Netscaler exploitation (CVE-2023-3519), and phishing targeting financial and government sectors. While smaller than more established bulletproof providers, it remains a recurring source ofHealthcarereporting, we surfaced several live pages exhibiting this behavior. We also identified a standalone healthcare-themed page on the same infrastructure, which may have been used to throw off researchers, or could