Want someone's credentials? Just social engineer them. Phishing is still responsible for 91% of data breaches and has been for the last few years.
A Russian cyber mafia has created a website where just about any aspiring bad guy can generate a realistic-looking credentials phish and send it to whoever they want. This "PHaaS" site allows for potentially stealing the victim's username and passwords with practically no technical knowledge.
Fortinet published a blog post this Wednesday, and they provided details on this Russian-language site called "Fake-Game."
The site claims that it has been used to take over 688,610 accounts, is free to use, but has an upsell to “VIP accounts” that have extra benefits like browsing all other phished accounts. Fake-Game even has tech support and training videos.
To begin with, an aspiring "cybercrim" selects which website they want to create a credentials phish for. You can choose from a pull-down list that includes Facebook and Instagram, gaming platform Steam, and Email Service Providers like Gmail and Mail.ru.
The next thing that Fake-Game does is generates a URL with a unique affiliate ID that allows the site send the stolen credentials to the right "customer". Fake-Game provides the credentials Phish plus infrastructure to run it, but the end-user still needs to be social engineered. Sometimes the landing pages do not look all that good.
One you have tricked a victim into entering their credentials, the site tells you in Engrish: "In your base entered a new account!", and you see the data with the victim's email address or username, password, IP address, and language.
Unfortunately this PHaaS site lowers the barrier to entry even further for anyone starting to make a living in cybercrime. Hackers can do a lot of things with these creds: send ransomware attacks to others, trade them, sell them or a multitude of other nefarious activities.
You really want to step your users through effective security awareness training when the amount of attacks is rising.
Free Phishing Security Test
Cyber-attacks are rapidly getting more sophisticated. We help you train your employees to better manage the urgent IT security problems of social engineering, spear-phishing and ransomware attacks. Take the first step now. Find out what percentage of your employees are Phish-prone™ with our free Phishing Security Test (PST).
PS, don't like to click on redirected buttons? Cut & paste this link into your browser:
https://info.knowbe4.com/phishing-security-test-16
