When the Phishing Kit Is a SaaS Free Trial: Tracking a 21-Tenant Freshdesk Credential-Harvest Campaign
A note on the indicators below: all hostnames and URLs in this post are defanged (hxxps[:]//, [.]) so nothing in the page is clickable. Re-fang them only inside an isolated analysis environment. The detection rules in…
05 Sep 2026 · 2 min readread →