RiskIQ has observed another phishing kit that’s been pieced together from portions of other phishing kits.
“In early 2021, RiskIQ first detected a new phishing campaign targeting PayPal,” the researchers write. “The campaign, authored by an actor calling themself ‘Vagabon,’ looks to collect PayPal login credentials and complete credit card information from the victim. The kit doesn't display many unique characteristics and is a textbook example of a ‘Frankenstein’ kit. In this increasingly popular trend, threat actors piece together new phish kits from modular, free, or readily available kits and services.”
The phishing kit is designed to trick victims into entering their PayPal information before redirecting them to the legitimate PayPal website.
“Following the initial PayPal username and password theft, the kit has a flow for further data theft, moving on to pages for account information and credit card data,” RiskIQ says. “Once the victim enters PayPal credentials, personal information, and credit card information, they redirect to the official PayPal website, which, to them, may seem like a perfectly legitimate place to end up. The attacker will then receive a ‘VagabonSpam’ email containing all victim data points via the done.php file.”
The kit was apparently compiled from portions of code written by people who speak different languages.
“The Vagabon kit contains files written in four different languages: English, Spanish, French, and Arabic,” the researchers write. “Predominantly, files are English and Spanish or English and Arabic. However, some contain three or four languages, depending on the file function and the need to recall other foreign language files or functions. The Vagabon kit, like many modern phish kits, contains code specific to blocking known research companies and common user agents. This code can be found within the .htaccess file as well as a bots.php file. The Vagabon PayPal kit will execute various processes, such as leveraging a user's IP geographic information to set the language and parameters for data validation as well as the exfiltration email address.”
New-school security awareness training can enable your employees to recognize phishing and other social engineering attacks.
RiskIQ has the story.
Here's how it works:
