Post #4178005

@reput_io@infosec.exchange the way PhantomGraph is doing it is by a deterministic combination based on preceding behaviors and not so reliant on the atomic observable indicator. Even if there are legit human verification gates in the click flow being abused by attacker infrastructure, the method of delivery, header info mismatch, lure language, and content will still and malicious; if the web page had already exhibited phishy behavior before the captcha, it will follow that thread and show the downloaded scripts too!