Montana Empire Phishing Kit ZIP with PHP Backend Components

Duo Tech@duotech

•updated Jul 1, 2026•1•0•2

Detects the presence of the Montana Empire phishing kit within ZIP archives. The rule identifies specific PHP backend components (mentalite.php, panel_track.php, verify_api.php) often used for credential harvesting, along with unique branding strings and artifacts suggesting AI-assisted development of the phishing kit.