Campaigns

Phishing kits that share exfiltration infrastructure — a Telegram bot token, chat ID, Discord webhook, or mail drop — are the same operator.