We’re gonna need a bigger boat: An analysis of recently caught phishing kits

Phishing is big business. The industry includes a variety of criminal players doing specialized work to steal and sell your information. Our research shows why phishing campaigns are so pervasive. Here’s what you need to know.

What is phishing?

Phishing is a type of social engineering attack that aims to trick victims into voluntarily providing account credentials or other personal identifiable information. Phishers know how to manipulate human nature and emotions to make the victim do what they want.

Phishers use email messages to induce fear, a sense of urgency, curiosity, reward, or validation. The emails can include a link or an attachment with a link that directs the victim to a website that impersonates a real organization. Phishers use the stolen information for their own monetary gain, either for identity theft or a sale on dark web marketplaces or messaging services like WhatsApp, Signal, or Telegram.

Phishing attacks are conceptually simple, but they are difficult to counter. Anti-phishing technologies such as email gateways are typically only available to enterprises, and few resources exist to safeguard consumers.

What are phishing kits?

A phishing kit is the web component to a phishing attack. Some phishing kits are closely held by their creators, while others are offered as part of the cybercrime-as-a-service economy.

The term cybercrime-as-a-service refers to an organized business model in the cybercriminal ecosystem to provide products and services to anyone willing to purchase them. Here the threat actors often provide access to already hacked web servers, or a list of recipient emails the buyer can use as part of the phishing attack.

Phishing kits are easy to use, and they allow anyone with minimal technical skills to become successful phishers. Before involving any victims, the phisher creates a website with a look and feel of the legitimate website they are trying to spoof, making it difficult for an average user to distinguish between the real site and the fake one. The easiest way to achieve this is by using a phishing kit.

After configuring and uploading the phishing kit to a web server either compromised or owned by the phisher, a phishing email is sent to victims, leveraging social engineering to lure the user to click on a link to the spoofed website.

If the victim is fooled, they visit the website and enter sensitive information such as account credentials or other personal identifiable information. The phishing website transmits the information back to the phisher, typically via email. However, some phishing kits exist where the information is transmitted via messaging services like Telegram, or simply stored in a text file on the server.

The phisher is now in possession of the victim’s information and will attempt to use it for monetary gain, either directly by using the credentials on legitimate websites and identity theft, or by selling it on marketplaces.

Interesting finds in a nutshell

We analyzed more than 1,500 unique URLs used to host phishing kits that formed part of our analysis. We found that 85% of phishing websites used a certificate. A valid certificate is visible to end users using a padlock in the browser bar, typically green. This padlock indicates that the traffic to and from the website is encrypted, but it provides a false sense of security to end users. It only means that the connection is secure—it does not indicate whether the site itself is secure. Simply put, a green padlock only ensures that no one else can spy on and steal the data you enter, but it can still be stolen if the site is malicious.

We have seen that 85% of phishing sites used a certificate. Phishers use free “Domain Validation SSL Certificates” to trick the end user into thinking the site is secure. Certificates issued by cPanel and Let’s Encrypt are by far the most common ones we have identified. Cloudflare and Sectigo have less than 10% share each. Other certificates make up a very small part and include issuers like GoDaddy or ZeroSSL.    

More than half of the analyzed phishing kits were spoofing financial services, with Chase being the top target, followed by PayPal and Wells Fargo. The telecommunication industry was the second most used phishing kit target, with AT&T leading the top three, followed by Deutsche Telekom and Swisscom. The logistics and internet industry share third place. The top three logistics targets we identified were DHL, La Poste, and USPS. Yahoo, Daum, and Ionos are the most used targets in the internet industry.    

In-depth analysis of recently caught phishing kits

Phishing kits users

To look at the users of the phishing kits, we clustered exfiltration emails addresses—email addresses where phishing kits send the stolen data. Usually, phishing kit users exfiltrate data to multiple addresses for the purpose of redundancy. If one address is shut down, data can still be harvested from the alternate exfil addresses. Often, when phishers rotate their addresses, they don’t rotate all of them at the same time, using old addresses linked to previous phishing kits in their new operations alongside new addresses. The following is an example of how multiple addresses can be linked and associated with a single actor.

We created a graph with emails as nodes and phishing kits as edges. Now, if an address appears alongside various email addresses in a separate phishing kits, we can trace and cluster all of them. Every isolated graph created now represents a phishing kit user.

In more than 2,500 phishing kits, only 362 unique phishing kit users could be identified.

Backdoors

Often, phishing kits are distributed with backdoors. This is code, which  exfiltrates stolen data to a party that the phishing kit user is unaware of. It is usually the the creator or the distributor of the phishing kit. This is achieved by using hidden mail function calls that are either disguised or obfuscated from the phishing kit user.

Following is an example of one such backdoor. The mail function call is hidden in the middle of a single-line file. The arguments of the function areobfuscated using hex and base64 encoding. Code obfuscation is the act of deliberately obscuring code, making it very difficult for humans to understand. Making the code more difficult to understand is done on purpose so that the kit user has a hard time identifying backdoor code and thereby removing it before using it themselves. When the hidden mail functions is executed, it sends a secret email of the stolen data to fbeheer@keemail[.]me, fbeheer@protonmail[.]ch

Multiple targets

We also found some of the kits had multiple targets.  The reason for having multiple targets in the same phishing kit is to maximize profit for kit distributors. These phishing kits are designed in such a way that adding more targets requires minimum effort. The distributor or creator only needs to change some files to change the appearance of the page and reuse the rest of the phishing code.

Here’s an example of one such kit that targets both Australian Post and Norwegian Post:

In this case, the email for one of the targets (Norway Post) does not seem to be filled by the phisher and is left as the generic email stand-in left by the author.

Blocklists

We also observed the usage of multiple methodologies to evade detection by security vendors, thereby increasing the longevity of the phish. These include:

1. Using third-party services to check for usage of proxies or VPN services
2. Using local blocklists of IPs in PHP code
3. Blocking certain host names associated with bots and security vendors
4. Blocking certain User-Agent strings
5. Blocking IP addresses from certain internet service providers (ISPs)
6. Blocking combinations of User-Agent strings and operating systems associated with security vendors

Dynamic directory

Another evasion technique that phishing kits employ is moving the entire phishing kit to a random directory (folder) and then redirecting the victim to that directory for their entire session.

This allows the phishers to hide the actual link of the phish, thereby extending its life.

Data exfiltration

While analyzing the phishing kits, we encountered three  major methods used to exfiltrate data from victims.

1. The most used method exfiltrates data via emails. It's simple and easy to maintain. These addresses can be changed easily if blocklisted. The blocklisted list contains the emails which had already been identified in phishing attacks by security products.
2. The second most common method we encountered is the usage of Telegram chatbots. This is a relatively new method, which is  wreaking havoc in the phishing threat landscape. Telegram’s automated chatbots are being leveraged to steal data and is being widely used in scam-as-a-service operations recently. These phishing kits are equipped with Telegram chatbots, and the victim’s data is sent to these channels.

The addition of chatbots to traditional exfil methods serves following advantages:

• Chat platforms like Telegram are end-to-end encrypted and therefore difficult to take down.
• It builds more redundancy into the operations.
• Because it uses HTTPS — a network communication protocol which encrypts data and send through a secure channel, it is stealthier and less suspicious. SMTP traffic (Simple Mail Transfer Protocol — a communication protocol which is used in sending and receiving emails) — is monitored in most organizations, as they have dedicated email servers, which are expected to generate this traffic.

3. The third method is the storage of data in files that are exfiltrated later via backdoors.

Types of data exfiltration

The general trend of collected data by the observed phishing kits included these details:

• Login credentials        
• Credit card details      
• Personal information (often including password recovery questions)

Clustering phishing kits

Research methodology

The phishing kits were primarily clustered based on the similarity between the files of different kits. The analysis focused on the following file types:

1. PHP code file
2. HTML code file
3. JS code file

For calculating the degree of similarity between two files, the Levenstein distance algorithm (a technique which is used to measure the difference between two sequence of characters)  was used with appropriate thresholds.

A graph was created from the data with phishing kit as nodes and similar files between phishing kits as edges. All isolated graphs were clusters, indicative of a set of phishing kits having similar files present within them. A visualization of a small portion of the similarity graph:

Most of the phishing kits passed the filters for similarity analysis, and these, when clustered, resulted in 79 unique clusters. We observed two types of clusters:

1. Small-medium-sized clusters that target particular industries.
2. Large clusters which target multiple industries.

Analysis of these phishing-kit clusters reveal that there is considerable code reuse between different kits. Usage of similar code sections in these different clusters is indicative of:

1. A single author.
2. Group(s) that is/are providing phishing kits to target an industry.
3. Authors/actors plagiarizing code from one another.

Logistics Industry Cluster

Example of similar code observed in these phishing kits:

As can be seen above, all of the similar phishing kits send stolen data in the sameformat, but each is sending it out to different receivers, which we refer to as phishing kit users. It can also be observed that 2/4 kits exfiltrate data using telegram. 3/4 use email, and 4/4 write the data to a file.

An example of similar code between these phishing kits:

Cluster Primarily Targeting Financial Services

An example of similar code between these phishing kits:

Cluster Targeting Various Industries

Similar code between these phishing kits:

Conclusion

To sum it all up, phishing has become a large industry bigger than just the organizations targeted. Segments of the industry include development of phishing kits, distribution to phishers, designing and distributing the phish lure, procurement of phishing infrastructure, and the sale and utilization of the stolen data. T

Further, the industry is constantly innovating to circumvent phishing detection techniques. Furthermore, there is an emphasis on higher returns from the actors by faster development, longer stealthier operations, and cheaper infrastructure by hosting on compromised webservers.

Innovations from Norton Labs are for research, evaluation, and consumer feedback purposes. NortonLifeLock does not give any warranties as to the suitability or usability of these prototypes and recommends safeguarding data and reviewing all terms and conditions before use.

Copyright © 2021 NortonLifeLock Inc. All rights reserved. NortonLifeLock, the NortonLifeLock Logo, the Checkmark Logo, Norton, LifeLock, and the LockMan Logo are trademarks or registered trademarks of NortonLifeLock Inc. or its affiliates in the United States and other countries.