GeorgeGinx PhaaS is active against US organizations, with observed activity across government, IT, banking, and healthcare, using Adobe Shared Links as a trusted redirect layer for Device Code phishing. See the full attack chain and collect IOCs: https://app.any.run/tasks/067a4287-9021-45fe-a454-845ed020b8ef/
An admin panel found on the attack IP links the infrastructure to this PhaaS. Pivot across related activity, uncover reused infrastructure, and track evolution in TI Lookup.
https://www.reddit.com/gallery/1wzz6el
Source: r/ANYRUN · by /u/ANYRUN-team