Formula 1 Phishing Campaign & Kit Analysis

This report analyzes a sophisticated, active phishing campaign targeting Formula 1 ticket buyers: operators cloned legitimate ticketing sites (134 pages) across at least 11 domains, run a 40-PHP-file backend, capture card data and session details, and use a BIN-based, bank-branded verification system with a live operator-controlled fraud panel to bypass MFA and exfiltrate data to a C2 (144.31.3.209). It includes technical artifacts, attack flow, victim targeting (Middle East bank customers), and recommended defensive actions.