BlobPhish Credential Exfiltration POST

Elgonad .@elgonad

•updated Apr 20, 2026•1•0•208

Detects HTTP POST requests destined for specific PHP endpoints (/res.php, /tele.php) frequently used by the BlobPhish campaign to exfiltrate stolen credentials from memory-resident phishing pages.