Unmasking Phishing: Strategies for identifying 0ktapus domains and beyond

This blog post analyzes active phishing campaigns attributed to 0ktapus (Scattered Spider), cataloging DOM templates, example phishing domains and IOCs, and describing techniques—application fingerprinting, network profiling, and domain-registration analysis—for pivoting between known and unknown phishing landing pages; it also includes recommendations for detection and prevention of credential-theft campaigns.