Kali365 Encrypted Phishkit JS Configuration Decrypted at Runtime
Detects the presence of specific configuration strings ('design' and 'flow_type') within HTTP response bodies, which are indicative of the Kali365 phishing kit decrypting its configuration at runtime via the browser. This pattern is characteristic of credential harvesting pages.
Microsoft Sentinel (KQL)
