FlowerStorm/Storm-1167 AiTM credential exfil via POST /google.php

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•4

Detects network activity associated with the FlowerStorm/Storm-1167 phishing campaign. The rule monitors for credential exfiltration to a specific malicious URI (e.g., /google.php) containing login parameters, as well as the delivery of spoofed Microsoft sign-in pages from the associated phishing infrastructure.