Do Son Unit 42 reveals "living" phishing pages built by GenAI on the fly. These polymorphic attacks evade detection by generating unique code for every victim.
LogoKit
A phishing campaign impersonates HunCERT & WeTransfer, using LogoKit on AWS S3 with Cloudflare Turnstile to steal credentials. The active domain has zero VirusTotal detections.