Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
<h1>Introducing Cavalier’s New Threat Feeds: Deep Dive into Phishing-as-a-Service (PhaaS) Intelligence</h1>
<p>We are thrilled to introduce three new Threat Feed modules in Cavalier: <strong><a href="https://www.infostealers.com/article/introducing-cavaliers-new-threat-feeds-deep-dive-into-infostealer-c2-intelligence/" rel="noreferrer" target="_blank">C2 Data</a></strong>, <strong><a href="https://www.infostealers.com/article/introducing-cavaliers-new-threat-feeds-deep-dive-into-clickfix-monitoring/" rel="noreferrer" target="_blank">ClickFix</a></strong>, and <strong>PhaaS (Phishing-as-a-service)</strong>. Together, they give security teams comprehensive visibility into active attacker infrastructure – from infostealer command-and-control (C2) servers to malicious ClickFix pages executing clipboard injection, to turnkey Phishing-as-a-service (PhaaS) kits targeting corporate credentials.</p>
<img alt="Overview of the Threat Feeds monitoring options" src="https://www.infostealers.com/wp-content/uploads/2026/07/threatfeeds1.png" />
Overview of the new Threat Feeds monitoring options available inside Cavalier, including the dedicated PhaaS Feed.
<h2>What’s New: PhaaS Intelligence</h2>
<p>As Phishing-as-a-Service (PhaaS) platforms become extremely prominent in high-profile corporate hacks, giving lower-tier actors turnkey access to advanced credential harvesting tools, preemptive visibility is more critical than ever. The new PhaaS Threat Feed is <strong>unique to Hudson Rock</strong>, providing an unparalleled view into active phishing host networks before they are deployed in targeted spear-phishing campaigns against your workforce.</p>
<img alt="Overview of the PhaaS feed in Cavalier" src="https://www.infostealers.com/wp-content/uploads/2026/07/phaas_0.png" />
A high-level overview of the Phishing-as-a-Service (PhaaS) intelligence feed within Cavalier, enabling security teams to monitor active phishing host networks and operational statuses.
<p>Inside Cavalier, security teams can seamlessly review:</p>
<ul>
<li>Active phishing host networks and root domains</li>
<li>Specific kit tags and deployment platforms</li>
<li>Resolved IP nodes and server infrastructure</li>
<li>Infostealer credential telemetry linked to the hosting platform</li>
</ul>
<h2>Tracking the Most Dangerous Phishing Kits</h2>
<p>Cavalier groups PhaaS hosts by their specific operational kits, allowing defenders to understand the exact tactics they are facing. Our intelligence tracks massive networks running well-known platforms like <strong>Eviltokens</strong> and <strong>Kali365</strong>, as well as exclusive, recently uncovered campaigns like <strong>SessionSerpent</strong>—intelligence you will only find surfaced through Hudson Rock.</p>
<img alt="Examples of PhaaS infrastructure kits" src="https://www.infostealers.com/wp-content/uploads/2026/07/phaas_1.png" />
Detailed grouping of PhaaS hosts by kit, featuring prominent platforms like Kali365, Eviltokens, Generic PhaaS, and the recently uncovered SessionSerpent campaign, tracked exclusively by Hudson Rock.
<h2>Uncovering Infrastructure and Initial Access</h2>
<p>The PhaaS feed allows you to go beyond the domain level and map out the entire operational footprint of an attacker. For example, you can surface surface infrastructure like <em>garage-door-repair(.)cyou</em> running Eviltokens, or pinpoint specific IP nodes like <em>43.172.6.35</em> tied to Kali365 operations.</p>
<img alt="Infrastructure servers and resolved IPs" src="https://www.infostealers.com/wp-content/uploads/2026/07/phaas_2.png" />
Deep dive into an active PhaaS campaign, showing the underlying infrastructure servers, ASNs, and resolved IPs utilized by the threat actors to host their credential harvesting kits.
<p>Crucially, just like our ClickFix and C2 modules, the PhaaS feed integrates directly with our infostealer telemetry. This allows you to instantly see if a host domain (e.g., <em>webcindario(.)com</em>) has compromised employee credentials tied to it, revealing exactly how attackers gained initial control of the server to host their phishing infrastructure.</p>
<h2>Seamless API Integration for Proactive Defense</h2>
<p>By feeding these surfaced domains, IP networks, and hosting infrastructure directly into your perimeter controls, firewalls, and DNS sinks, organizations can preemptively block turnkey phishing networks before employees receive a single malicious email.</p>
<p>All datasets are fully accessible via REST API endpoints for automated ingestion into your SIEM or SOAR. Teams can utilize the <a href="https://docs.hudsonrock.com/reference/getphaasfeed" rel="noreferrer" target="_blank"><code>GET /json/v3/threat-feeds/phaas</code></a> endpoint to retrieve active Phishing-as-a-Service indicators with flexible filtering, or use the <a href="https://docs.hudsonrock.com/reference/getphaashostnetwork" rel="noreferrer" target="_blank"><code>GET /json/v3/threat-feeds/phaas/{host}</code></a> endpoint for specific host network lookups and operational status checks.</p>
<div>
<h3>Protect Your Organization from Imminent Intrusions</h3>
<p>With our new Threat Feeds, cybersecurity teams can monitor live C2 infrastructure from infostealer campaigns, ClickFix networks, and PhaaS operations to proactively block malicious communications.</p>
<p>To learn more about how Hudson Rock protects companies from intrusions caused by info-stealer infections of employees, partners, and users, and how we enrich existing cybersecurity solutions with our cybercrime intelligence API, please schedule a call with us, here:<br />
<a href="https://www.hudsonrock.com/schedule-demo" rel="noreferrer" target="_blank">https://www.hudsonrock.com/schedule-demo</a></p>
<p>We also provide access to various free cybercrime intelligence tools that you can find here:<br />
<a href="https://www.hudsonrock.com/free-tools" rel="noreferrer" target="_blank">www.hudsonrock.com/free-tools</a></p>
<p><strong>Thanks for reading, Rock Hudson Rock!</strong><br />
Follow us on LinkedIn: <a href="https://www.linkedin.com/company/hudson-rock" rel="noreferrer" target="_blank">https://www.linkedin.com/company/hudson-rock</a><br />
Follow us on Twitter: <a href="https://www.twitter.com/RockHudsonRock" rel="noreferrer" target="_blank">https://www.twitter.com/RockHudsonRock</a></p>
</div>
The post Introducing Cavalier’s New Threat Feeds: Deep Dive into Phishing-as-a-Service (PhaaS) Intelligence appeared first on InfoStealers.
Article Link: Introducing Cavalier's New Threat Feeds: Deep Dive into Phishing-as-a-Service (PhaaS) Intelligence | InfoStealers