🚨 #Wazza phishkit routing flow: 1️⃣ *[.]boegl-krysl[.]eu — unique wildcard landing. 2️⃣ /api/wazza-config — checks whether the hostname belongs to an active campaign. 3️⃣ beacon-surge-sync[...]workers[.]dev — issues a client marker to correlate the visit. 4️⃣ /api/mint-token — creates a short-lived signed session token. 5️⃣ check[.]boegl-krysl[.]eu — validates the token and browser telemetry, filters unwanted traffic. 6️⃣ boegl-krysl[.]eu/r ➡️️ /meline — after the anti-bot check, the victim is sent through two intermediate redirect endpoints to the final Adobe-themed Device Code phishing landing page. 🔍 Pivot from #IOCs and subscribe to query updates to proactively track evolving activity: https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=wazza_phishkit&utm_content=linktotilookup&utm_term=230926#%7B%22query%22:%22threatName:%5C%22wazza%5C%22%22,%22dateRange%22:90%7D