Security researchers at ANY.RUN say they have identified a phishing kit called Wazza targeting organisations in banking, manufacturing and government across the US, Europe and Australia. While phishing kits are not new, the reported technical approach matters because it suggests attackers are adding more control and filtering into the phishing delivery process itself, not just copying login pages.

For European businesses, this is a practical reminder that phishing campaigns are continuing to evolve. The risk is not limited to large enterprises or public institutions: suppliers, mid-sized manufacturers, service firms and companies with valuable payment, procurement or admin accounts may also be exposed.

What happened

According to the reported findings, Wazza is a phishing kit designed to target organisations in multiple sectors and regions, including Europe. The researchers describe a setup in which attackers use filtering, session management and traffic controls as part of the phishing infrastructure.

That means the malicious system may be able to decide who sees the phishing content, manage how victim sessions are handled and potentially reduce exposure to security tools or casual inspection. In practice, these controls can make phishing campaigns more selective and more resilient than basic fake login pages.

The source material indicates targeting of banking, manufacturing and government organisations. As with many phishing operations, the immediate objective is likely to be credential theft or account compromise, although businesses should avoid assuming every campaign works in exactly the same way without incident-specific evidence.

Why it matters for European businesses

For European companies, the main significance is that phishing infrastructure is becoming more sophisticated at the delivery layer. Traditional awareness remains important, but businesses should not rely on user vigilance alone.

• Higher chance of successful credential theft: More selective phishing delivery can improve attackers' ability to reach intended targets while avoiding simple detection.
• Operational risk beyond email: Stolen credentials can affect finance systems, Microsoft 365 or Google Workspace accounts, supplier portals, ERP systems, cloud dashboards and admin tools.
• Manufacturing exposure: Manufacturers are frequent targets because compromised accounts can affect procurement, logistics, engineering files and supplier communication.
• Potential downstream impact: A compromised account in one company can be used to target customers, partners or public-sector contacts through trusted email threads.
• Security control gap: If a business still depends mainly on passwords and basic spam filtering, it may be more exposed to modern phishing kits.

This is especially relevant in Europe, where businesses face growing pressure to strengthen cybersecurity governance, supplier risk management and identity protection. For some regulated or critical sectors, phishing resilience is not only a security issue but also part of broader compliance and operational continuity expectations.

Who may be affected

The reported campaign is most directly relevant to organisations in banking, manufacturing and government-related environments, but the practical exposure is wider.

• SMEs in manufacturing and industrial supply chains that use shared portals, invoice workflows and procurement systems
• Finance and accounting teams handling payments, banking access and vendor communications
• IT and security teams responsible for identity, email protection and cloud access
• Founders and executives whose accounts are often targeted for approval fraud or business email compromise
• Companies working with public-sector clients or regulated industries where account compromise can have contractual or reporting consequences

Even when a phishing campaign appears focused on larger institutions, smaller businesses can be targeted as stepping stones or easier-entry points within broader partner ecosystems.

What companies should consider

Based on the reported characteristics of this phishing kit, European businesses should review account protection and phishing response measures with a focus on identity security.

• Enforce phishing-resistant multi-factor authentication where possible for email, admin accounts, finance tools and cloud services.
• Review conditional access and login protections to detect unusual sign-ins, device changes and impossible travel patterns.
• Harden high-risk accounts such as finance, procurement, executive assistants, administrators and shared operational mailboxes.
• Improve email and web filtering but assume some phishing attempts will still reach users.
• Train staff on current phishing tactics, including realistic login pages, fake session prompts and supplier or bank-themed impersonation.
• Check for exposed credentials and session misuse after suspicious login events, especially in Microsoft 365, Google Workspace and business SaaS platforms.
• Prepare an account compromise playbook covering password resets, session revocation, MFA review, mailbox rule inspection and partner notification.
• Assess supplier risk if your business depends on email-based approvals, invoices or portal access from external partners.

The report does not by itself establish that all European businesses are directly targeted by this specific kit, but it does reinforce a broader trend: phishing operations are becoming more technically managed and more business-focused. For companies that depend on cloud identity, online banking, supplier workflows and remote administration, that raises the importance of stronger login security and faster incident response.