Indicators of Compromise (IOCs) for these kits are often static. For example, a known Facebook phishing kit created by an Indonesian threat actor is detected by the presence of specific strings like 1008501933214 (fake case number) or references to eriktohir.php (exfiltration script).
Several emerging trends will shape the next generation of phishing attacks:
Some kits not only steal credentials but also use Facebook's Graph API (if the stolen token is captured) to spam the victim's friends. This requires additional steps, but the post.php file might store the creds and then use cURL to authenticate.