Threat video1:00
Fake Copyright-Strike Phishing Estate: Detection & IOCs
A 110-domain kit fakes YouTube DMCA strikes to steal Google logins and session cookies. Includes 9 detection rules (one free in Splunk SPL) and 17 IOCs.
Read the full threat intel for Fake Copyright-Strike Phishing Estate: Detection & IOCs →
Chapters
- 0:00The hook110 domains ran one phishing kit.
- 0:04The storyVictims received fake copyright strikes.
- 0:12Attack pathThey registered domains behind Cloudflare.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromise15 indicators to hunt: 2 IPs, 10 domains and 2 file names, and more.
- 0:38MITRE ATT&CK techniques12 ATT&CK techniques, from resource development to impact.
- 0:42Remediation5 steps now: Load the domain naming families into hunting and email/web filtering.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00110 domains ran one phishing kit.
0:05Victims received fake copyright strikes.
0:07ZeroFox suspended 82 of the 110.
0:12They registered domains behind Cloudflare.
0:15Notices lead to a tokenized link.
0:17Scanners see a benign page.
0:19A fake Google window takes passwords.
0:22Then the hijacked channel is renamed.
0:26No threat actor is attributed. Confidence: medium.
0:3115 indicators to hunt: 2 IPs, 10 domains and 2 file names, and more.
0:3812 ATT&CK techniques, from resource development to impact.
0:435 steps now: Load the domain naming families into hunting and email/web filtering.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.