How an Exposed .git Folder Revealed a Phishing Campaign's Operations
By
spirovskib
6mo ago· 8 min readenInsight
100/100
Golden Brown
Bagelometer↗
Fresh out the oven, still warm. Top of the tray.
Score100TypeanalysisSentimentneutral
Summary
A cybersecurity researcher details how an exposed .git folder on a phishing website allowed them to uncover and dox an entire phishing campaign. The attacker's operational mistakes, including leaving the .git directory publicly accessible, enabled the researcher to access source code, configuration files, and ultimately identify the attacker's GitHub account and Telegram bot used for the campaign. The article serves as a case study in how attacker incompetence can become a defender's advantage in cybersecurity investigations.
Key quotes
· 4 pulledSometimes the attacker incompetence can be a defender's best weapon
An exposed .git folder let us dox a phishing campaign
We took up to research it and because of clumsy decisions by the attacker we got their GitHub and their operational Telegram bot
The phishing page was a standard clone of an 'email', unbranded and generic service
This past Friday afternoon, a member in our Discord server reported a phishing email pointing to a fake login page.
