New ‘Frankenphishing’ Tactic Combines Other Phishing Kits Into One
RiskIQ has observed another phishing kit that’s been pieced together from portions of other phishing kits.
“In early 2021, RiskIQ first detected a new phishing campaign targeting PayPal,” the researchers write. “The campaign, authored by an actor calling themself ‘Vagabon,’ looks to collect PayPal login credentials and complete credit card information from the victim. The kit doesn’t display many unique characteristics and is a textbook example of a ‘Frankenstein’ kit. In this increasingly popular trend, threat actors piece together new phish kits from modular, free, or readily available kits and services.”
The phishing kit is designed to trick victims into entering their PayPal information before redirecting them to the legitimate PayPal website.
“Following the initial PayPal username and password theft, the kit has a flow for further data theft, moving on to pages for account information and credit card data,” RiskIQ says. “Once the victim enters PayPal credentials, personal information, and credit card information, they redirect to the official PayPal website, which, to them, may seem like a perfectly legitimate place to end up. The attacker will then receive a ‘VagabonSpam’ email containing all victim data points via the done.php file.”
The kit was apparently compiled from portions of code written by people who speak different languages.
“The Vagabon kit contains files written in four different languages: English, Spanish, French, and Arabic,” the researchers write. “Predominantly, files are English and Spanish or English and Arabic. However, some contain three or four languages, depending on the file function and the need to recall other foreign language files or functions. The Vagabon kit, like many modern phish kits, contains code specific to blocking known research companies and common user agents. This code can be found within the .htaccess file as well as a bots.php file. The Vagabon PayPal kit will execute various processes, such as leveraging a user’s IP geographic information to set the language and parameters for data validation as well as the exfiltration email address.”
New-school security awareness training can enable your employees to recognize phishing and other social engineering attacks.
RiskIQ has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW