A new phishing kit abuses device-code sign-in to create valid attacker sessions, even without stealing the victim’s password. GajIPS detects the campaign before and during the lure stage.
Severity: High | Priority: 2
This GajIPS update adds network-layer detection for Wazza, a new phishing kit that ANY.RUN disclosed in October 2026. Wazza has been seen targeting banking, manufacturing and government organisations in the US, Europe and Australia. Before showing any phishing content, it passes each visitor through several stages of filtering:
Only visitors who pass every stage see the final lure, an Adobe-themed device code phishing page. Device code phishing does not steal a password. It tricks the victim into completing a sign-in on the attacker's behalf, which gives the attacker a valid session on the victim's account. Because the kit hides the final page from scanners and sandboxes, a Wazza link can look harmless when checked automatically.
The new signatures detect the campaign at several stages. They cover lookups and connections from hosts in your network to the Wazza landing domain and its beacon host. Where SSL inspection is enabled, they also cover the kit's campaign-check request. That detection does not depend on the domain, so it keeps working if the operator moves to new landing domains.
If these alerts trigger in your network, a user has opened a Wazza phishing link. Identify the user and ask whether they entered a code or approved a sign-in prompt after visiting the page. Search mail and messaging logs for the lure to find other recipients. If the user completed the device code step, treat the account as compromised:
Changing the password alone does not end a session the attacker obtained through a device code flow.