New Phishing-as-a-Service Platform

New Phishing-as-a-Service PlatformResearchers at Resecurity have discovered a new Phishing-as-a-Service (PhaaS) platform called “EvilProxy” that’s being offered on the dark web. EvilProxy is designed to target accounts on a variety of platforms, including Apple, Facebook, GoDaddy, GitHub, Google, Dropbox, Instagram, Microsoft, Twitter, Yahoo, Yandex.

Notably, EvilProxy has the ability to steal session cookies, which allows it to access accounts without needing a username, password, or multifactor authentication (MFA) tokens.

“EvilProxy actors are using Reverse Proxy and Cookie Injection methods to bypass 2FA authentication – proxyfying victim’s session,” the researchers write. “Previously such methods have been seen in targeted campaigns of APT and cyberespionage groups, however now these methods have been successfully productized in EvilProxy which highlights the significance of growth in attacks against online-services and MFA authorization mechanisms.... The reverse proxy concept is simple: the bad actors lead victims into a phishing page, use the reverse proxy to fetch all the legitimate content which the user expects including login pages - it sniffs their traffic as it passes through the proxy. This way they can harvest valid session cookies and bypass the need to authenticate with usernames, passwords and/or 2FA tokens.”

EvilProxy is being offered for $400 per month, and requires customers to undergo a vetting process to prevent researchers from getting their hands on it. The kit also has extensive anti-analysis features.

Resecurity adds that the platform is also very easy to use, further lowering the bar for inexperienced attackers to carry out sophisticated phishing attacks.

“The portal of EvilProxy contains multiple tutorials and interactive videos regarding the use of the service and configuration tips,” the researchers write. “Being frank – the bad actors did a great job in terms of the service usability, and configurability of new campaigns, traffic flows, and data collection.”

New-school security awareness training can enable your employees to follow security best practices so they can avoid falling for social engineering attacks.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Topics: Phishing

Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews