Wazza Phishkit Employs Multi-Stage Routing to Target Key Sectors

• •Wazza targets banking, government, and manufacturing sectors across multiple regions.
• •The phishing kit uses a multi-stage routing chain to evade detection.
• •MSSPs may experience increased investigation times due to the complexity of the attack.

A new phishing kit named Wazza has been identified, targeting banking, government, and manufacturing sectors across the US, Europe, and Australia. This sophisticated attack uses a multi-stage routing chain to filter visitors and automated traffic before delivering a final payload, which is an Adobe-themed Device Code phishing page. The attack begins at a wildcard landing domain and involves several endpoints that check for active campaigns and generate session tokens. Only after passing these checks does the visitor reach the phishing page, complicating detection efforts. Managed Security Service Providers (MSSPs) face challenges in investigating alerts due to the complexity of the attack chain. The campaign exemplifies a trend where attackers enhance their phishing infrastructure to evade detection.