Researchers at Resecurity have discovered a new Phishing-as-a-Service (PhaaS) platform called “EvilProxy” that’s being offered on the dark web. EvilProxy is designed to target accounts on a variety of platforms, including Apple, Facebook, GoDaddy, GitHub, Google, Dropbox, Instagram, Microsoft, Twitter, Yahoo, Yandex.
Notably, EvilProxy has the ability to steal session cookies, which allows it to access accounts without needing a username, password, or multifactor authentication (MFA) tokens.
“EvilProxy actors are using Reverse Proxy and Cookie Injection methods to bypass 2FA authentication – proxyfying victim’s session,” the researchers write. “Previously such methods have been seen in targeted campaigns of APT and cyberespionage groups, however now these methods have been successfully productized in EvilProxy which highlights the significance of growth in attacks against online-services and MFA authorization mechanisms.... The reverse proxy concept is simple: the bad actors lead victims into a phishing page, use the reverse proxy to fetch all the legitimate content which the user expects including login pages - it sniffs their traffic as it passes through the proxy. This way they can harvest valid session cookies and bypass the need to authenticate with usernames, passwords and/or 2FA tokens.”
EvilProxy is being offered for $400 per month, and requires customers to undergo a vetting process to prevent researchers from getting their hands on it. The kit also has extensive anti-analysis features.
Resecurity adds that the platform is also very easy to use, further lowering the bar for inexperienced attackers to carry out sophisticated phishing attacks.
“The portal of EvilProxy contains multiple tutorials and interactive videos regarding the use of the service and configuration tips,” the researchers write. “Being frank – the bad actors did a great job in terms of the service usability, and configurability of new campaigns, traffic flows, and data collection.”
New-school security awareness training can enable your employees to follow security best practices so they can avoid falling for social engineering attacks.
Here's how it works:
