N0va Phishkit Verification/Session-Init URL Pattern

Arnold Chan@slaz

•updated Sep 16, 2026•2•0•4

This rule detects network traffic indicative of N0va Phishkit verification or session initialization. It looks for specific GET request URI parameters (/api/verification/init?session=, flow=, prompt_profile=) that align with the initial handshake phase of this phishing kit, which is often used for credential and session cookie theft.