New Insight into Cybercrime: Phishing-as-a-Service Platform

With the launch of the PaaS platform under the name ‘Caffeine,’ threat actors now have a chance to launch sophisticated phishing attacks quickly. A new report shows that anyone interested in beginning a phishing campaign must pass through an open registration process on this platform.

When investigating the phishing activity, Managed Defense analysts discovered that the Caffeine platform has an intuitive interface that it provides to users at a relatively low cost. To design and automate the main components of its phishing campaigns, Caffeine has provided a variety of tools and functions to its criminal clients. Self-service techniques to manage transitional redirect pages, customized phishing kits, a final stage webpage for seducing victims, campaign email activity tracking, and robust URL generation for hosted malware payloads are some of the features provided by the platform.

Another team of researchers at Resecurity recently discovered a similar platform named EvilProxy. Unlike Caffeine, EvilProxy is provided on the dark web. The latter targets accounts on different platforms, including Facebook, Dropbox, Google, Instagram, Yahoo, Twitter, GoDaddy, Apple, Microsoft, Yandex, and GitHub. It can also steal session cookies, which allows the attacker to access accounts without the need to key in a password, username, or other MFA (multi factor authentication) tokens.

Why You Should Care

The progress in automated detection and inspection methods using email security platforms have significantly evolved phishing tactics. The attacks orchestrated through platforms such as EvilProxy and Caffeine are pretty lethal as they apply Reverse Proxy and Cookie Injection approaches to bypass 2FA authentication. According to recent discoveries, the platforms allow attackers to proxify the victim’s session.

The reverse concept used in this context has been considered to be simple. The bad actors’ work is to lead their victims to a phishing page and apply the reverse proxy to obtain all the victim’s legitimate content expected by the user, including the login pages. The software is so good that it can sniff the user’s traffic when passing through the proxy. Through the process, the attackers harvest cookies for the valid session, thus successfully bypassing the need for authenticating with passwords, usernames, or 2FA tokens.

As cybercriminals continue to enhance their offerings, phishing attacks will become more challenging to spot and combat. Moreover, their frequency will rise, eventually becoming a greater liability to companies. With the new campaigns through such platforms, response plans and employee awareness will no longer be preventative, implying that they will necessitate more robust cybersecurity.

Ways to Combat PaaS

Although the future of Phishing as a Service is worrying, experts contend that it is not yet bleak for companies. Perspectives and focus on Cybersecurity need to shift away from perceiving phishing as highly complicated than an email that looks odd.

Researchers recommend three key strategies companies should adopt to combat PaaS effectively. The first move is to start with the source by taking actions such as frequently updating the cyber defense technologies, which help filter many phishing methods. The second move is to educate the workers on what to watch out for and the appropriate response. The last step is to put in place a standard response plan for the company, as opposed to an individualized approach.

Use our simulated phishing tests for defence against social engineering attacks. Although a lot of businesses today utilize technology to protect themselves from cyber risks, user training has been a key defence against phishing scams. Leading practices like the Keepnet Phishing Simulator and cyber security awareness training enable your workforce to be ready for social engineering assaults. The Keepnet Phishing Simulator will test your users in various departments, and they will encounter these threats before they are truly targeted. Additionally, they will receive the most recent and interesting training materials to help them recognize cyberattacks like data or identity theft.