GhostCode Phishing Kit Harvester API Endpoint Access

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•1

Detects incoming HTTP GET requests targeting known API endpoints associated with the GhostCode phishing kit. These endpoints (/api/harvester) are used by the phishing kit to poll for session details, device codes, or flow identifiers, characteristic of credential harvesting operations.