AnonyMousKIT PhaaS shared codebase files (legacy.js/Core.js/ToolsController.php)

Ibrahim Saud@tektrix

•updated Sep 23, 2026•1•0•5

Detects the presence of known AnonyMousKIT Phishing-as-a-Service (PhaaS) shared components (legacy.js, Core.js, ToolsController.php) by matching specific file hashes or detecting these filenames in small files. This rule is designed to identify backend infrastructure used by phishing resellers.