FlowerStorm: Microsoft 365 phishing kit with MFA relay, loaded from cloud object storage

One hunt for the family. YARA anchor: the loader page (public CDN libraries followed by bootstrap.min.js from the root of a numbered Tencent Cloud bucket). Search anchor: the second rule, which matches the kit script itself (it opens with a base64-encoded server address and carries the kit's MFA prompt names), or pages that contacted a kit bucket or kit server seen so far: passionatematt411-1323985617, profresultbox-1323985617, blessinngsnonstop-1322272810, 2023blessings-1322272810, professorjacobian-1322272810 and hjgjuhu7yyutyth6y5t-1457164341 (each under .cos.<region>.myqcloud[.]com), the kit servers profresu[.]site and mdirc.mysticpathways[.]de, and the R2 lure buckets listed in the query. The number in a bucket name is the Tencent Cloud account, so a new bucket on the same account is the same operator. Most kit buckets were disabled in early October 2026; a lure page whose kit no longer loads still carries the loader. A page protected with KrakVM is labelled separately and is not part of this hunt on its own, because the obfuscator is public.