Known malicious kitcriticalphishing
DOUBLECUP — CRM-brand phishing lures (SMQL tracker)
family: doublecup-clickfix-laas
CRM-brand look-alike domains (NetSuite, Odoo, Salesforce, HubSpot) used as DOUBLECUP lure pages, as published by SOCRadar.
Anchors
SMQL queryrun
domain:*login-netsuite.com OR domain:*login-odoo.com OR domain:*login-salesforce.com OR domain:*verification-salesforce.com OR domain:*login-hubspot.com OR domain:*pending-verification.comProvenance
Added: 2026-08-04 08:53
The DOUBLECUP indicators are split across several entries in this family, one per indicator class. The YARA entry in this family is the protocol-based anchor that survives infrastructure rotation.