NoLimitSecu #512 - StalkPhish

In this episode of NoLimitSecu, host Hervé Chaur and co-hosts Nicolas Ruf and Vladimir Cola interview Thomas Damonneville, a cybersecurity expert with over 25 years of experience, about his project StalkPhish. Damonneville explains that StalkPhish is an open-source tool designed to collect and enrich phishing feeds, including phishing kits and their configurations. The project aims to understand phishing actors, their infrastructure, and exfiltration vectors. He details how StalkPhish uses certificate transparency logs and community-driven feeds like PhishTank to gather data. The tool can pivot on IP addresses, favicon hashes, and other artifacts to identify campaigns and actors. Damonneville also discusses the commercial version, StalkPhish.io, which offers more advanced features for threat intelligence professionals. He highlights the importance of analyzing phishing kits to extract configuration files that reveal Telegram bots, channels, and other exfiltration methods. The conversation covers countermeasures used by phishers, such as geofencing and user-agent filtering, and the challenges of bypassing them. Damonneville emphasizes the need to focus on actors rather than just taking down URLs, and mentions his collaboration with law enforcement. He concludes by encouraging listeners to support the project and engage in the fight against phishing.