Advanced Wazza Phishing Kit Leverages Multi-Stage Routing and Device Code Tactics to Target Critical Global Sectors

The landscape of email-based threats is undergoing a fundamental transformation. Phishing kits, once simple scripts designed to mimic a familiar login page and harvest credentials, have evolved into sophisticated web infrastructures. Modern attackers are increasingly integrating complex filtering, session management, and traffic control mechanisms directly into the delivery chain. These advancements are designed to bypass automated security scanners and ensure that only "qualified" victims reach the final malicious payload.

Cybersecurity researchers at ANY.RUN have recently identified a new and highly evasive phishing kit dubbed "Wazza." This campaign specifically targets high-value organizations within the banking, manufacturing, and government sectors across the United States, Europe, and Australia. Unlike traditional phishing attempts that rely on a direct link to a fake login site, Wazza utilizes a multi-stage routing chain to screen visitors. By validating telemetry and session data in real-time, the kit effectively hides its final Adobe-themed Device Code phishing page from security researchers and automated detection bots.

For modern security teams, the emergence of Wazza represents a shift in adversarial tactics. The campaign demonstrates how attackers can control every step of the victim’s journey, making the initial malicious link appear benign or uninformative to traditional security tools. This complexity complicates the incident response process, particularly for Managed Security Service Providers (MSSPs) who must manage alerts across diverse customer environments while maintaining strict service-level agreements.

The Technical Architecture of Wazza’s Multi-Stage Routing

The primary innovation within the Wazza phishkit is its use of a layered delivery infrastructure. It does not indiscriminately serve its phishing content to every IP address that clicks the link. Instead, it employs a series of "gates" to ensure the visitor is a human target and not an automated security crawler or a sandboxed environment.

The attack chain typically begins at a wildcard landing domain, such as [.]boegl-krysl[.]eu. When a potential victim interacts with the link, the request is first directed to an endpoint labeled /api/wazza-config. This initial stage acts as a configuration check, determining whether the specific hostname used in the link is part of an currently active and authorized campaign. If the hostname does not match the attacker’s internal database of active campaigns, the routing stops, or the user is redirected to a legitimate site to avoid suspicion.

If the first check is passed, the infrastructure contacts a secondary service, identified as beacon-surge-sync[...]workers[.]dev. This component issues a unique client marker, which serves as a fingerprint for the visitor’s session. This allows the attackers to correlate the visit across different stages of the routing chain. Following the issuance of this marker, the kit contacts /api/mint-token, which generates a short-lived, signed session token. This token is critical; without it, the final phishing page cannot be accessed, preventing researchers from simply navigating to the final URL to analyze the lure.

The final gate involves a validation service at check[.]boegl-krysl[.]eu. Here, the Wazza kit validates the previously minted token alongside the visitor’s browser telemetry. This stage is designed to filter out unwanted traffic, such as bots, search engine indexers, and security scanners that do not exhibit "human" browser behavior. Only after these rigorous checks is the visitor allowed to proceed through the final redirects—typically /r and /meline—to reach the Adobe-themed landing page.

Social Engineering via Device Code Phishing

Once a victim successfully navigates the routing gauntlet, they are presented with a sophisticated social engineering lure. Wazza utilizes an Adobe-themed interface, capitalizing on the widespread use of Adobe products in corporate and government environments. However, the kit does not merely ask for a username and password. Instead, it employs a "Device Code" phishing flow.