AnonyMousKIT-style phishing kit exfil to Telegram Bot API webhook

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•2

This rule set detects network communication patterns associated with the AnonyMousKIT phishing kit, specifically targeting the exfiltration of captured user credentials to the Telegram Bot API and communication with known phishing panel infrastructure. It monitors for DNS lookups of 'anomkit.shop', established TCP connections to the associated backend relay, and HTTP requests containing specific credential-related keywords directed towards the Telegram API.