🚀 Create IOK: steam-tu2yq4ic (#255)

* 🚀 Create IOK: steam-tu2yq4ic * Update steam-tu2yq4ic.yml Detection logic improvement --------- Co-authored-by: IlluminatiFish <[email protected]>
phish-report · May 20, 2024 · a6b13c2 · a6b13c2
1 parent 052afce
commit a6b13c2
Showing 1 changed file with 27 additions and 0 deletions.
diff --git a/indicators/steam-tu2yq4ic.yml b/indicators/steam-tu2yq4ic.yml
@@ -0,0 +1,27 @@
+title: Steam Phishing Kit tu2yq4ic
+description: Steam Phishing Kit that uses a fake Steam login window to steal user credentials.
+
+references:
+  - https://urlscan.io/result/21e56cd4-f042-4856-86cb-192372b403b7
+  - https://urlscan.io/result/f77fb88a-d6cc-4355-92e5-0527ddd5cf00
+  - https://urlscan.io/result/0a4bd282-305a-47cc-b239-c251d53f7382
+
+detection:
+
+  warning:
+    html|contains: 
+      - '<div id="NotLoggedInWarning" class="modal_frame">'
+
+  breadcrumbs:
+    js|contains|all:
+      - 'vgywykkm.uq'
+      - 'lppfocvr.fo'
+      - '.oxisae'
+      - '.zooms'
+      - '#groobly'
+
+  condition: warning and breadcrumbs
+
+tags:
+  - kit
+  - target.steam