New Wazza Phishing Kit Hits Banks, Gov't, Manufacturers

Wazza Phishkit Targets Banks, Government, and Manufacturers

A phishing kit called Wazza is being used in credential-theft campaigns against banking, government, and manufacturing organizations across the United States, Europe, and Australia, according to research published October 8, 2026 by ANY.RUN, a threat intelligence and malware sandbox provider. A phishkit is a pre-built package of fake login pages, scripts, and backend infrastructure that lets an attacker run a credential-stealing campaign without building the phishing site from scratch.

What makes Wazza notable is not the industries it targets, which overlap with longstanding phishing priorities, but how it is built. According to ANY.RUN, Wazza includes filtering, session management, and traffic controls baked directly into the infrastructure that serves the fake login page, rather than relying only on a static copy of a real brand's sign-in screen. That shift reflects a broader trend the researchers describe: phishing kits are evolving from simple page clones into small-scale web applications designed to manage who sees the bait and how their session is handled once they interact with it.

Why Built-In Filtering Makes a Phishing Kit Harder to Catch

Traffic filtering and session management are not new to phishing generally, but packaging them into the kit itself is a meaningful operational change. In phishing campaigns that use this architecture, the serving infrastructure can inspect incoming visitors, such as their IP address, browser fingerprint, or referring link, before deciding whether to show the real fake login page or a harmless decoy. That kind of gatekeeping is commonly used across the phishing ecosystem to keep security researchers, automated scanners, and sandbox tools like ANY.RUN's from ever seeing the live phishing content, which can delay detection and slow down takedown requests sent to hosting providers.

Session management inside the kit also means the attacker's infrastructure, not just the victim's browser, is tracking where a target is in the attack flow: whether credentials were entered, whether a one-time passcode was requested, and whether the session should be forwarded in real time to bypass multi-factor authentication. This mirrors techniques long seen in adversary-in-the-middle phishing frameworks, where a stolen session token or relayed one-time code can let an attacker log in as the victim even when MFA is enabled. ANY.RUN's description of Wazza as combining filtering, session handling, and traffic controls in one kit suggests the operators behind it are lowering the technical bar for running this kind of session-aware attack at scale, which matters for any organization that assumes SMS or app-based MFA alone fully closes the phishing risk.

What This Means For Your Business

If your organization is in banking, government, manufacturing, or works closely with vendors in those sectors, this report is a reason to revisit phishing defenses now rather than after an incident. A few concrete steps apply directly:

• Move toward phishing-resistant MFA. Session-aware phishing kits are built to intercept or relay one-time codes and SMS passcodes. FIDO2/WebAuthn security keys or platform passkeys resist this because the authentication is bound to the legitimate domain and cannot be relayed through a lookalike site.
• Shorten session token lifetimes and enforce re-authentication for sensitive actions like wire transfers, payroll changes, or access to regulated data, so a stolen session has a smaller window of use.
• Monitor for lookalike domains and newly registered infrastructure mimicking your bank, vendor, or government portal login pages, and report suspicious domains to your registrar or a service like the Anti-Phishing Working Group.
• Train staff to expect convincing, targeted lures rather than obviously broken fake pages. Kits with built-in filtering are designed to show a polished page only to real intended victims, which means the pages your employees do see are more likely to look legitimate.
• Review incident response playbooks for session hijacking specifically, not just password resets, since a compromised session can bypass the password change step entirely until the session itself is revoked.

Tax professionals, healthcare practices, and other small-business operators that are not direct targets named in this report should still take note. Phishkit code and infrastructure patterns commonly get reused and resold across criminal marketplaces, and a kit built for banking and government lures today can be repurposed against smaller organizations' payroll, EHR, or billing portals tomorrow. Treating MFA hardening, session timeout policies, and domain monitoring as standard practice now is cheaper than responding to a credential-theft incident later.

ANY.RUN's research has not been independently verified by Bellator Cyber Guard, and specific technical details of Wazza's operation beyond what the firm has described publicly remain unconfirmed. Readers should watch for follow-up advisories from national CERTs or financial-sector information sharing groups such as FS-ISAC if Wazza activity is confirmed against specific organizations.