Date: 11/19/2025
Severity: Medium
Summary
A highly automated, multi-stage phishing kit has been uncovered impersonating the major Italian IT provider Aruba S.p.A., a company central to Italy’s digital infrastructure. The kit uses CAPTCHA filtering, data pre-filling, and Telegram-based exfiltration to steal credentials and payment information efficiently and stealthily. Its design reflects the broader rise of phishing-as-a-service (PhaaS), where phishing tools are built and operated like commercial SaaS products. This industrialization makes modern phishing campaigns more scalable, convincing, and difficult to detect—transforming them into a full-fledged criminal supply chain rather than isolated scams.
Indicators of Compromise (IOC) List
URLs/Domain | serdegogozedeytid.bulkypay.xyz serdegogozedeytidtelerstore.marina.am scarecrow.metalseed.you2.pl wordpress-1512889-5811853.cloudwaysapps.com firsijdaeeuetevcbcsj.cfolks.pl arb-app.nero-network.eu srv229641.hoster-test.ru |
IP Address | 31.28.24.131 23.239.109.118 192.250.229.24 109.95.159.70 45.77.157.140 185.208.164.121 185.25.23.155 |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "scarecrow.metalseed.you2.pl" or siteurl like "scarecrow.metalseed.you2.pl" or url like "scarecrow.metalseed.you2.pl" or domainname like "firsijdaeeuetevcbcsj.cfolks.pl" or siteurl like "firsijdaeeuetevcbcsj.cfolks.pl" or url like "firsijdaeeuetevcbcsj.cfolks.pl" or domainname like "wordpress-1512889-5811853.cloudwaysapps.com" or siteurl like "wordpress-1512889-5811853.cloudwaysapps.com" or url like "wordpress-1512889-5811853.cloudwaysapps.com" or domainname like "serdegogozedeytid.bulkypay.xyz" or siteurl like "serdegogozedeytid.bulkypay.xyz" or url like "serdegogozedeytid.bulkypay.xyz" or domainname like "serdegogozedeytidtelerstore.marina.am" or siteurl like "serdegogozedeytidtelerstore.marina.am" or url like "serdegogozedeytidtelerstore.marina.am" or domainname like "arb-app.nero-network.eu" or siteurl like "arb-app.nero-network.eu" or url like "arb-app.nero-network.eu" or domainname like "srv229641.hoster-test.ru" or siteurl like "srv229641.hoster-test.ru" or url like "srv229641.hoster-test.ru" |
Detection Query 2 : | dstipaddress IN ("109.95.159.70","23.239.109.118","45.77.157.140","192.250.229.24","31.28.24.131","185.208.164.121","185.25.23.155") or srcipaddress IN ("109.95.159.70","23.239.109.118","45.77.157.140","192.250.229.24","31.28.24.131","185.208.164.121","185.25.23.155") |
Reference:
https://www.group-ib.com/blog/uncover-phishing-italy/