GreenSpot APT Targets NetEase 163.com Users with Fake Download Pages & Spoofed Domains

Hunt.io research attributes a credential-harvesting phishing campaign to the GreenSpot APT, which impersonates NetEase (163.com) services via rapidly-registered domains and spoofed login/download pages; the report documents attacker infrastructure (domains, IPs, TLS certificate behaviors), malicious JavaScript/PHP that captures credentials, example decoy files, and a table of IOCs, and recommends enabling MFA and enhanced monitoring to mitigate this targeted campaign.