Montana Empire Phishing Kit Credential Capture Endpoint POST

Duo Tech@duotech

•updated Jul 1, 2026•1•0•3

Detects HTTP POST requests to known phishing kit endpoints 'panel_track.php' or 'verify_api.php', which are associated with the Montana Empire credential harvesting campaign.