FlowerStorm phishkit credential exfil via POST to /google.php

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•5

Detects outbound HTTP POST requests to a URI path '/google.php' containing suspicious parameters 'do=login&user=' and '&pass='. This pattern is indicative of credential exfiltration activities commonly associated with the FlowerStorm campaign.