Analysis of the latest phishing-as-a-service (PhaaS) platform ONNX Store highlights just how successful these platforms can be.
Security analysts at threat intelligence vendor Eclectic IQ have been tracking ONNX Store, noting it’s a rebranded evolution of the Caffeine PhaaS platform. According to analysis, ONNX has been used to target financial institutions, “including banks, private funding firms and credit union service providers across the EMEA and AMER regions.”
This platform uses a combination of socially-engineered phishing emails, QR codes contained within PDF attachments, impersonated Microsoft 365 authentication pages hosted on bulletproof hosting services, proxied MFA, and encrypted JavaScript code to avoid detection.
Eclectic IQ mapped out all the services, websites, bots and more used as by this sophisticated platform:
Source: Electric IQ
It's a rather elaborate setup that should have organizations worried. Something this advanced, which takes into account just about every way a user or security solution could detect it’s a phishing attack, is troublesome.
However, the one element of the attack that even ONNX can’t mimic perfectly is the phish itself. It requires the recipient to believe they need to open a PDF attachment and then use their mobile phone to scan the QR code to read the document.
Users that undergo continual security awareness training will realize when first receiving such an email that it’s unexpected and – therefore – suspect to begin with.
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
