Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia
- ID
- 33159
- Status
- summarized
- Published
- 08 Oct 2026, 6:30 PM
- Fetched
- 08 Oct 2026, 8:00 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/10/wazza-phishkit-targets-banking.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.5
- Created
- 08 Oct 2026, 8:02 PM
- Tags
- Audience
- developerssaas_founders
What happened
ANY.RUN's analysis of 'Wazza' describes a phishkit hitting banking, manufacturing, and government organizations in the US, Europe, and Australia, using a multi-stage routing chain instead of a single static lure page. Traffic hits a wildcard landing domain (boegl-krysl[.]eu) which calls /api/wazza-config to check whether the hostname belongs to an active campaign, contacts beacon-surge-sync[...]workers[.]dev to issue a client marker, then mints a short-lived signed session token via /api/mint-token. Only after a token and browser-telemetry check at check[.]boegl-krysl[.]eu passes does the visitor reach an Adobe-themed Device Code phishing page.
Why it matters
Two concrete things worth acting on. First, the final lure is OAuth device-code phishing, which targets the device authorization grant designed for input-limited devices - if your product or your staff SSO tenant (Microsoft, Adobe, Google) permits device code flow, a password plus MFA does not stop this, so the decision is whether to block or restrict that grant in conditional access. Second, the payload sits behind a signed-token anti-bot gate and campaign-prefix check, so a single URL reputation scan of the initial link may never surface the phishing page; only detonation-style analysis does. There is no Malaysia-specific angle in this text.
Discussion angle
The kit's own infrastructure rides on free serverless (workers.dev) and a signed-token gate - does your detection stack block workers.dev wholesale, and if so, what legitimate services break? Pair that with the device-code question: check your tenant's conditional access policy live during the call.