Wazza Phishkit Routes Traffic Through Four-Stage Chain Before Adobe Device Code Lure

The kit begins at a wildcard landing domain, queries /api/wazza-config, contacts beacon-surge-sync workers.dev for a client marker, then mints a signed token at /api/mint-token. Only validated browser telemetry reaches the final Adobe-themed page. This sequence differs from single-redirect kits by embedding session control inside the delivery path itself. ANY.RUN sandbox traces confirm the token validation gate rejects automated scanners, lengthening MSSP triage windows across customer environments. Similar routing patterns appeared in earlier EvilProxy and Caffeine campaigns but without the token-minting step tied to sector-specific prefixes. Procurement records from defense contractors show increased spending on sandbox telemetry precisely to counter this class of infrastructure. The added hops raise the cost of reliable blocklisting while lowering the signal-to-noise ratio for Tier-1 analysts. Expect continued refinement of short-lived token lifetimes and browser fingerprint checks as operators observe detection rates.