WMC Insight+ for Phishing Kits

Uncover the Kits Behind the Campaign

Mobile phishing campaigns frequently utilize reusable kits, which are pre-packaged bundles of HTML, JavaScript, images, and scripts that enable rapid, convincing brand impersonation. WMC Insight+ contains one of the largest libraries of unique phishing kits for analysis.

Investigate kit files and artifacts to uncover patterns that connect multiple domains to the same source. Use what you find to derive IOCs, accelerate takedowns, and guide proactive hunts. You can also upload kits discovered in the wild to expand coverage.

Proactive Discovery. Stronger Takedowns

Benefits of using WMC Insight+ for phishing kit intelligence

Zero-Day Visibility

Identify emerging templates and kit families before full campaigns appear.

Attribution Clarity

Cluster shared code, assets, and exfil methods to link activity across brands and infrastructure.

Actionable Indicators

Extract domains, paths, images, and patterns that strengthen rules and detections.

Scales to Reality

Search and retrieve artifacts at volume; export what matters to your workflows.

How it Works

Step-by-step example how phishing kitss are used within WMC Insight+

Collect & Browse

Access a large and growing phishing kit library; filter and open specific kits.

Inspect Files

View HTML, JavaScript, images, and supporting scripts to understand behavior.

Derive Indicators

Extract filenames, hashes, code snippets, and assets for detection and hunts.

Correlate

Connect kit traits across domains/URLs and (when applicable) identities.

Act

Feed IOCs to your controls, support takedown requests, and inform response playbooks.

WMC Insight+ for Phishing Kits

Key Capabilities

File-Level Exploration

Inspect the actual files that make brand abuse work (HTML/JS/images/scripts), not just the resulting pages

User Kit Uploads

Submit kits you discover to expand coverage and speed analysis

IOC Derivation

Turn artifacts into IOCs (filenames, hashes, paths, images) and find related campaigns sooner

Large Kit Corpus

Hundreds of thousands of kits available for analysis (and growing)

Faster Coorelation

Shared artifacts connect multiple domains to the same kit family

Better Disruption

Evidence grounded in underlying tooling improves takedown success

Hierarchy View

Navigate parent kit → nested files cleanly instead of flat, exploded lists

URL↔Kit Linkage

Click from a domain/URL to its originating kit and back to speed investigations

Validation & Dedupe

Improve library hygiene with pre‑ingest checks and near‑duplicate detections (coming soon)

Integrations. Security. Access

Export IOCs

to SIEM/SOAR, EDR, and web/email security tools for proactive blocking.

Feed Indicators

to detection pipelines and URL submission for broader discovery.

Use APIs

(where applicable) to pull kit metadata into your internal investigation workflows.

Tenants & Roles

Reader/Analyst/Admin roles with scope appropriate to your organization.

Upload Controls

Phishing kit uploads accepted; validation/deduplication are planned to enhance integrity.

Auditability

Track when kits are inspected or exported for operational oversight.

Compliance Friendly

Supports evidence‑based takedown processes and internal review.

FAQs

What is a phishing kit? A reusable bundle of HTML, JS, images, and scripts used by attackers to quickly clone branded experiences and harvest data.

Can I upload kits found outside of WMC Insight+? Yes. User kit uploads are supported to expand the library. A validation/dedupe process is planned to improve hygiene.

How do I connect kits to malicious domains? Analysts can correlate via shared artifacts today. Direct URL ↔ Kit drill‑through is on the roadmap to make this instant.

Can I export indicators from a kit? Yes. Derive and export hashes, filenames, asset paths, and code snippets to supercharge hunts and automated blocking.

Are there other phishing kit features coming to WMC Insight+? Yes. Pre‑ingest validation/deduplication for higher signal quality and faster pivots.

Can we connect this to our current tooling? Absolutely! Scoring, Retrieval, and Submission APIs support SIEM/SOAR/WAF workflows and takedown processes.

Phishing Kits