Phishing Kit Prices Rise

iStock-1141440065 (1)The price of phishing kits on the black market rose by 149% in 2019, according to researchers at Group-IB. ZDNet reports that the researchers tracked the pricing of 16,200 phishing kits by following ads on criminal forums, and found that the average cost reached $304 in 2019, compared to just $122 in 2018.

Phishing kits are applications that allow criminals to easily set up spoofed websites that automatically harvest credentials and send them to the attacker. Phishing kit developers usually offer a series of templates to spoof popular sites, as well as components to evade detection by security products.

Group-IB attributes the rise in prices to the fact that email security filters and other phishing defenses have grown more effective. As a result, phishing kit developers have needed to build more complex features to evade detection. More complexity means more work for the developers, which results in a higher-priced product.

The researchers believe another factor that’s driving prices up is that buyers themselves are gravitating toward more expensive phishing kits, since cheap kits have developed a well-deserved reputation for containing backdoors.

If this assessment is correct, then, as ZDNet puts it, “this is very good news.” Email security defenses are constantly working to make attackers’ jobs more difficult, and this trend indicates that their efforts are succeeding.

However, Group-IB also notes that the number of phishing kit sellers rose by 120% in 2019, and the number of phishing kits doubled. Most of these kits enabled the spoofing of login pages for Amazon, Google, Instagram, Office 365, and PayPal.

This also doesn’t mean criminals will stop trying to use phishing and other social engineering techniques to steal credentials or gain access to organizations’ networks. A price bump of under $200 isn’t likely to dissuade someone who’s serious about launching phishing campaigns.

Attackers will always be working to bypass security filters, and some phishing emails will always slip through the cracks. New-school security awareness training can complement your technical defenses by enabling your employees to recognize these emails.

ZDNet has the story:

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews