Phishing kit reusable stage-2 payload download via dl.php access-token parameter with PE response

Arnold Chan@slaz

•updated 29 days ago•0•0•0

Detects an HTTP GET request to 'dl.php' containing an 'f' parameter (target file) and an 'k' parameter (access token), followed by a response body starting with the 'MZ' header, indicating the successful download of a Windows PE executable as part of a potential phishing campaign stage-2 payload delivery.