Travel Partner - Phishing Kit Type

#TravelPartner #PhishingKitType #phishing #phishingkit

@sniko_ documented a phishing kit that targets Apple passwords called "Travel Partner".

It may contain text in it such as
    $$ Travel Partner Apple V 1.5 $$
    kir4@snsv-crew.id
    nkir4@snsv-crew.id
    $headers = "From: ".$ccname." <k1r4@snsv-crew.id>";




The kit may contain a file called "update.txt" that has a release history and contract email

The phishing kits are standard looking Apple login pages

PxIntelligence documented another similar kit with the "update.txt" and email address above
        classeamotoclube[.]com[.]br

     apple.zip
        f74b796bf040b391d8a553ac98601a4acd58451eb1dbc966c2176cf5ea66a958

References
https://twitter.com/sniko_/status/1076906305376436224
https://pxintelligence.com/snapshots/75143/