FlowerStorm AiTM credential exfiltration via /google.php POST

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•5

Detects HTTP POST requests containing potential credential exfiltration indicators, specifically targeting the '/google.php' endpoint with 'do=login&', 'user=', and 'pass=' parameters. This pattern is associated with FlowerStorm (Storm-1167) AiTM phishing kits.