Wazza Phishkit Evolves with Advanced Infrastructure to Target Key Sectors
A new phishing kit named Wazza employs sophisticated multi-stage routing and filtering to evade detection and target banking, government, and manufacturing sectors across the US, EU, and Australia.
Phishing kits have moved beyond simple credential harvesting, with attackers increasingly integrating advanced features into their delivery infrastructure. The Wazza phishkit, identified by ANY.RUN, exemplifies this evolution, targeting critical sectors like banking, manufacturing, and government organizations across the United States, Europe, and Australia.
Wazza's primary innovation lies in its multi-stage routing chain. Instead of directly presenting a phishing page, the campaign first screens visitors and filters automated traffic. This approach complicates detection by making initial links appear less malicious and requires a specific environment or user interaction to reveal the final payload. This layered defense mechanism is designed to bypass automated security systems and make the phishing attempt more resilient.
The attack chain begins at a wildcard landing domain, where visitors are passed to an endpoint that checks for active campaigns. The infrastructure then contacts a separate domain, which issues a client marker for correlating visits. Subsequently, an API endpoint generates a short-lived, signed session token. This token is crucial for the next stage, where Wazza validates the token and browser telemetry, further filtering out unwanted traffic before the visitor proceeds to the final lure.
Only after successfully navigating these validation gates does the visitor reach the phishing page. In observed campaigns, this final stage often mimics a recognizable service, such as Adobe's Device Code authentication flow. This familiar branding helps to legitimize the request, making users more likely to proceed with authentication, which is the ultimate goal for the attackers. The Device Code flow specifically targets account authentication, moving beyond traditional username and password theft.
The reach of Wazza is significant, with activity detected across the US, Europe, and Australia. The targeted sectors—banking, manufacturing, and government—are particularly attractive due to the sensitive data and high-value business processes they manage. Financial institutions handle critical transaction data, manufacturers rely on interconnected systems, and government organizations manage classified information and essential services. This broad targeting demonstrates the adaptability of Wazza's infrastructure.
For Managed Security Service Providers (MSSPs), Wazza presents a unique challenge. The evasive nature of the kit means that a suspicious URL might initially appear benign, especially if automated systems cannot replicate the full routing sequence. Analysts investigating alerts across multiple customer environments face increased uncertainty, potentially leading to longer investigation times, unnecessary escalations, and reduced capacity for handling genuinely complex threats.
The sophistication of Wazza highlights a broader trend in phishing attacks: the increasing complexity of the delivery infrastructure. Attackers are investing more in making their phishing operations harder to detect and analyze. This requires defenders to adopt more dynamic analysis techniques and to understand the full attack chain, not just the final payload.
Ultimately, Wazza's multi-stage routing, session validation, and familiar branding represent a significant step forward for phishing kits. Its ability to target high-value sectors across multiple regions underscores the ongoing need for robust security measures and advanced threat detection capabilities to combat evolving cyber threats.