Researchers at Mandiant have published an analysis of a phishing-as-a-service kit called “Caffeine,” which further lowers the bar for inexperienced cybercriminals by offering a publicly available, easy-to-use phishing service.
“Unlike most PhaaS platforms Mandiant encounters, Caffeine is somewhat unique in that it features an entirely open registration process, allowing just about anyone with an email to register for their services instead of working directly through narrow communication channels (such as underground forums or encrypted messaging services) or requiring an endorsement or referral through an existing user,” the researchers write. “Additionally, to seemingly maximize support for a variety of clientele, Caffeine also provides phishing email templates earmarked for use against Chinese and Russian targets; a generally uncommon and noteworthy feature of the platform.”
The phishing kit also offers a customer support service for inexperienced users, along with a simple user interface.
“Once registered, a new Caffeine user is then directed to the service’s main index page to begin their phishing voyages,” the researchers write. “It is worth noting that over the course of its investigation into the Caffeine platform, Managed Defense observed Caffeine’s administrators announce several key platform improvements via the Caffeine news feed, including feature updates and expansions of their accepted cryptocurrencies.”
The phishing kit also facilitates finding hosting services for phishing campaigns.
“For most traditional phishing campaigns, phishermen generally employ two main mechanisms to host their malicious content,” Mandiant says. “They will typically leverage purpose-built web infrastructure set up for the sole purpose of facilitating their phishing voyages, use legitimate third-party sites and infrastructure compromised by attackers to host their content, or some combination of both.”
New-school security awareness training can enable your employees to recognize phishing and other social engineering attacks.
Mandiant has the story.
Here's how it works:
