ANY.RUN Identifies Wazza Phishkit Targeting US, EU, and Australian Sectors

Security researchers at ANY.RUN have identified a new phishing infrastructure known as Wazza, which is actively targeting critical sectors across the United States, Europe, and Australia. The campaign specifically aims at banking, government, and manufacturing organizations, marking a shift in how attackers deploy credential harvesting tools.

According to reporting by The Hacker News, the Wazza phishkit represents a significant evolution in phishing infrastructure. Traditional phishing kits often rely on simple static copies of login pages, waiting passively for victims to enter credentials. In contrast, Wazza integrates complex functionalities directly into the infrastructure that delivers the malicious pages. These capabilities include traffic controls, filtering mechanisms, and active session management, allowing attackers to maintain more persistent and controlled interactions with victims.

Technical Evolution of Phishing Infrastructure

The identification of Wazza highlights a broader trend in cybercrime where attackers are moving beyond basic credential theft. By embedding session management and traffic controls into the delivery infrastructure, operators can better manage the flow of compromised data and potentially evade detection longer than with static pages. This approach allows for more dynamic interactions, where the phishing site can respond to user behavior or specific network conditions, rather than simply serving a pre-built HTML page.

ANY.RUN’s analysis underscores that these kits are no longer limited to copying a familiar login interface. The integration of backend controls suggests that the operators behind Wazza are investing in more sophisticated tooling to maximize the yield of their campaigns. This technical sophistication makes detection more difficult, as the infrastructure behaves more like a legitimate application server than a simple mirror site.

Scope of the Campaign

The geographic and sectoral scope of the Wazza campaign indicates a broad targeting strategy. Organizations in the United States, Europe, and Australia are all identified as targets. Within these regions, the attackers are focusing on high-value sectors that hold sensitive data and financial assets. Banking institutions are a primary target, likely due to the immediate financial gain from compromised credentials. Government organizations are also targeted, potentially for access to sensitive state data or as a foothold for further espionage activities. Additionally, manufacturing firms are being targeted, which may indicate an interest in intellectual property or supply chain disruption.

The widespread nature of the campaign suggests that the Wazza infrastructure is scalable and designed to handle multiple campaigns or targets simultaneously. The presence of traffic controls implies that the operators are managing a significant volume of traffic, filtering out non-target users or security researchers while allowing legitimate-looking traffic to pass through to the credential harvesting endpoints.

What should you do?

Security teams should monitor their email gateways and proxy logs for indicators of compromise associated with the Wazza infrastructure. Since the kit uses session management, look for unusual session tokens or persistent cookies in browser traffic logs that do not correspond to known legitimate services. Review DNS query logs for newly registered domains or domains with suspicious SSL certificate patterns that may be hosting the phishing pages.

What to do and how to stay safe: Wazza

• Inspect email filters for phishing attempts mimicking banking, government, or manufacturing portals, paying close attention to URL structures that may indicate dynamic content generation.
• Monitor web proxy logs for unusual session behaviors, such as persistent cookies or tokens that remain active across different domains or after expected expiration times.
• Analyze DNS traffic for connections to newly registered domains or domains with mismatched SSL certificates that could be hosting the Wazza infrastructure.
• Educate users in targeted sectors about the risks of interacting with login pages that exhibit unexpected behavior or request additional information beyond standard credentials.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the Wazza phishkit?

Wazza is a new phishing infrastructure identified by ANY.RUN that targets banking, government, and manufacturing organizations with advanced features like session management and traffic controls.

Which regions are affected by the Wazza campaign?

The campaign targets organizations in the United States, Europe, and Australia.

How does Wazza differ from traditional phishing kits?

Unlike traditional kits that use static login pages, Wazza integrates filtering, session management, and traffic controls into its delivery infrastructure.