Excited to see the open-source canarytokens.org offering #Azure #CanaryTokens! One more type of sensitive data that attackers now need to worry about using: https://blog.thinkst.com/2023/02/canarytokens-org-welcomes-azure-login-certificate-token.html
More information here: https://docs.canarytokens.org/guide/cloned-web-token.html#what-is-a-cloned-website-token basically the original URL is stored in JS that checks the current URL to see if it's ben hosted elsewhere.
@jacob
Thank you.
@jacob
However anyone worth their salt would be suspicious running obfuscated JS and if not obfuscated it would be too obvious.
In the end the prevalence of this method combined with obfuscation will make these attacks more expensive.
People who are making fake paypal.com login pages are not sophisticated, and thus get caught by these types of things, they are not reversing minified JS to check for this. If they are, it slows down their work and makes them more dificult.
