Kali365 Encrypted Phishkit JS Configuration Decrypted at Runtime
Detects the presence of specific configuration strings ('design' and 'flow_type') within HTTP response bodies, which are indicative of the Kali365 phishing kit decrypting its configuration at runtime via the browser. This pattern is characteristic of credential harvesting pages.
Cortex XDR
