"coinbase-panel.zip" is a malicious archive containing a phishing kit designed to steal credentials and two-factor authentication (2FA) codes from Coinbase users [2, 3]. It utilizes cloned login pages, backend scripts to exfiltrate data, and mechanisms to bypass 2FA, with common IoCs including file variations and Telegram bot integration [4, 5]. You can find more details on this threat in the analysis of the phishing kit.
