iimp0ster

Translate AiTM and device-code phishing kit observations into draft Tacklebox atomics + rigs. Hunts named kit families (Tycoon 2FA, Mamba 2FA, Sneaky 2FA, EvilProxy, FlowerStorm/ODx, ONNX, Greatness, Evilginx, EvilTokens, Kali365) via OSINT (URLScan, VirusTotal, Hunt.io, etc.) AND grounds post-auth procedures in tier-1 research (Sekoia, Microsoft TI, Push Security, SpecterOps, Dirk-Jan Mollema). Produces machine-readable draft artifacts under intel/kits/<kit-slug>/ for human promotion. Never writes to atomics/ or rigs/ directly. Use when triaging a suspect AiTM page, enriching an existing kit family with new procedures, or producing pipeline-ready intel on post-authentication behavior. Distinct from infra-malware-delivery-hunter (which hunts masquerading software delivery infrastructure, not credential harvest).