Known malicious kithighphishing
Prove / small-financial-brand phishing framework (panelFronts devtools-trap kit)
family: prove-financial-framework-202608
Short link:scanmalware.com/h/172
Shared phishing framework documented by urlscan 2026-08-04, deployed against deliberately LOW-PROFILE financial and identity brands rather than megabrands: Prove (identity verification), US Bank SinglePoint, AMINA E-Banking, Currency Cloud, Pleo, Slim CD, PayMongo, Aspire. Cloudflare-fronted, several hosts sharing a nameserver pair. Anchored on the kit-unique global __panelFrontsDevtoolsTrapStarted__ (a devtools-detection-trap guard) — a framework identifier coded into the kit logic, so it survives host rotation and minification, unlike IP/domain/hash IoCs.
Anchors
YARA ruleProve_Financial_Phishing_Framework
SMQL queryrun
js_library:socket.io AND (title:"currencycloud" OR title:"paymongo" OR title:"slim cd" OR title:"amina bank" OR title:"singlepoint" OR title:"prove identity")Provenance
Added: 2026-08-07 13:12
The YARA rule is the primary anchor. Its marker, including hex, unicode, URL-encoded, fromCharCode and triple-base64 forms, matched no legitimate pages in testing. True-positive coverage is unvalidated: this framework has not yet been captured, so the rule has never matched a real sample; if the first live hit shows a renamed global, re-anchor on that sample rather than loosening the rule. The query half approximates urlscan's second pivot (a bundled socket.io library plus a targeted brand in the page title), because the socket.io file hash was withheld from the public report.
Sightings (0)
No sightings recorded yet.