Cybersecurity
ANY.RUN identified Wazza phishkit targeting US, Europe and Australia
ANY.RUN said Wazza used layered routing and token checks to screen visitors before serving an Adobe-branded Device Code phishing page, and described the kit as aimed at banking, manufacturing and government organisations.
- ANY.RUN said it had identified Wazza, a phishkit aimed at banking, manufacturing and government organisations in the US, Europe and Australia.
- The article said Wazza used several routing checks before showing an Adobe-branded Device Code phishing page.
- The path described in the article involved boegl-krysl.eu, /api/wazza-config, beacon-surge-sync[...]workers.dev, /api/mint-token, check.boegl-krysl.eu, and then boegl-krysl.eu/r and /meline.
- The article also promoted ANY.RUN's Interactive Sandbox, Threat Intelligence Lookup and Threat Intelligence Feeds as ways to analyse suspicious URLs and reuse indicators across customer environments.
ANY.RUN said it had identified Wazza, a phishing kit linked to activity against banking, manufacturing and government organisations in the US, Europe and Australia. The piece said the kit did not send every visitor straight to the lure.
Instead, it described a sequence of checks that decided whether a request would continue. The flow began on boegl-krysl.eu and moved through /api/wazza-config, beacon-surge-sync[...]workers.dev, /api/mint-token and check.boegl-krysl.eu.
Only traffic that passed those steps reached a page dressed with Adobe branding. The article said that page used the Device Code authentication flow, which aimed at account access rather than password harvesting.
The article then turned to ANY.RUN's own products, saying its Interactive Sandbox could open suspicious URLs in virtual machines and generate reports quickly. It also presented Threat Intelligence Lookup and Threat Intelligence Feeds as ways to turn one investigation into indicators that could be reused elsewhere.
Named in this story
Companies
- ANY.RUN
- said it identified Wazza and promoted its analysis tools
- Adobe
- the branding copied by the final phishing page
Products and systems
- Wazza
- the phishkit described in the campaign
- Interactive Sandbox
- the sandbox ANY.RUN said analysts could use to detonate suspicious URLs
- Threat Intelligence Lookup
- the lookup tool ANY.RUN said analysts could use to pivot from indicators
- Threat Intelligence Feeds
- the feed product ANY.RUN said streamed validated indicators
Places
- US
- one of the regions the campaign targeted
- Europe
- one of the regions the campaign targeted
- Australia
- one of the regions the campaign targeted
How the source tells it
The article read like vendor marketing, mixing threat framing with repeated claims about faster investigations and lower analyst load.
- vendor boosterism repeated self-promotional claims about sandbox speed, threat feeds and reduced escalations
- threat inflation describing the kit as more than a malicious URL and as a broader problem for MSSPs
- urgency time-saving and scale claims framed the product as a response to immediate workflow pressure