Kratos Phishing Kit Credential POST to Primary Exfiltration Endpoint (next.php/nex.php/n3xt.php/officers*eur.php)

Duo Tech@duotech

•updated Jul 14, 2026•1•0•3

Detects HTTP POST requests indicative of credential exfiltration associated with the Kratos phishing kit. The rule monitors for specific endpoint patterns (e.g., next.php, nex.php, n3xt.php, or officers*eur.php) commonly utilized by this kit to receive stolen credentials.