.

indicators/valorant-7plil474.yml

@@ -0,0 +1,32 @@
+title: Valorant Phishing Kit 7plil474
+description: |
+    Detects a phishing kit targeting Valorant players. It is typically spread on 
+    social media platforms such as TikTok, often luring in gamers using popular 
+    figures such as Tenz, Kyedae and MrBeast.
+
+references:
+    - https://www.tiktok.com/search/video?q=mrbeast%20valorant
+    - https://urlscan.io/result/ceb1f3d8-efed-40b3-85e4-6c9eecd182b7/
+    - https://urlscan.io/result/48118e59-979c-48e7-b332-bb802dc5e941/
+    - https://urlscan.io/result/5421601f-f2aa-41a5-bf6b-85a264bee2f7/
+
+detection:
+
+    requests:
+      requests|endswith|all: 
+         - '/login'
+         - 'logins.css'
+         - '/t/1.css?apiType=css&projectid=dce2cd3c-2b49-496c-8fe8-f7eedea7aa2b'
+
+    jsVariables:
+      js|contains|all:
+        - 'makeid'
+        - 'rqdata_token'
+        - 'login_mfa'
+
+    condition: requests and jsVariables
+
+tags:
+    - kit
+    - target.valorant
+    - target.riotgames

indicators/valorant-landing-page-7plil474.yml

@@ -0,0 +1,28 @@
+title: Valorant Phishing Kit Landing Page 7plil474
+description: |
+    Detects the landing pages used by the phishing kit detected by the valorant-7plil474 rule.
+references:
+    - https://www.tiktok.com/search/video?q=mrbeast%20valorant
+    - https://urlscan.io/result/35050e0b-f38d-4671-8728-489538351167/
+    - https://urlscan.io/result/fb92d735-7209-48dc-8c06-0c23f013f0ef/
+    - https://urlscan.io/result/9ced04ab-e67e-4ac5-9d9c-0993f69f3f55/
+    - https://urlscan.io/result/e6f5c3bc-85e6-4fda-a276-709c52ac403b/
+related:
+    - id: valorant-7plil474
+
+detection:
+
+    jsVariables:
+      js|contains|all:
+        - 'start'
+        - 'checkAlreadyGot'
+        - 'getItem'
+        - 'getRandom'
+        - 'generateItems'
+
+    condition: jsVariables 
+
+tags:
+    - kit
+    - target.valorant
+    - target.riotgames