Known malicious kithighphishing
Multi-step sign-in phishing kit with credential and verification handlers
family: multistep-signin-relay-kit-2026-10
Short link:scanmalware.com/h/326
Sign-in phishing pages using a shared kit that collects usernames, passwords and verification codes through multi-step handlers. Sighted on herstel-google[.]com, n1-us-google[.]com and cccr[.]one; shared code links the pages but does not establish a common operator.
Anchors
SMQL queryrun
fp_canonical:5cc585bb4fba5987460780c4fe394ca7199ccba720fcba322daa9958fbf93337 OR fp_canonical:362a0aa895c91c532f28ce316f599596815d1615f481d79e04688c3677a717c9 OR similar_code:be2bb73e55e5ee7d09582e13de4ac5d93b5e2c285f07c9347f0218535a7ea84eProvenance
Added: 2026-10-30 23:25
Matches fingerprints of the kit's sign-in and URL-spoofing scripts and structurally similar sign-in scripts. The kit sends submitted data to same-site endpoints including /sign-in, /sign-in-2 and /phone-otp.