Executive Summary
A new phishing kit named Wazza has been identified targeting high-value sectors including banking, government, and manufacturing across the United States, Europe, and Australia. Unlike traditional phishing pages that harvest passwords, Wazza utilizes the OAuth Device Code flow to gain persistent access to victim accounts and sessions, complicating detection by bypassing standard credential-based security controls.
The attack chain is characterized by its high degree of operational security, using a multi-stage routing infrastructure to filter out automated analysis and unwanted traffic. It leverages landing domains like boegl-krysl[.]eu to validate campaign hostnames, generate signed session tokens, and perform browser telemetry checks via dedicated anti-bot gates before finally presenting the malicious lure.
For organizations, Wazza represents a significant threat because the initial phishing links appear unremarkable to automated scanners. The kit's ability to selectively serve payloads based on visitor attributes allows it to evade static blacklists and Tier 1 automated triage, potentially leading to increased dwell time and account compromise within targeted sectors.
Key Details
Threat Name
Wazza OAuth Phishing
Affects
—
Adversary
—
MITRE Techniques
—
Malware/Tools
Wazza