Phishing Kit Prices Rise

The price of phishing kits on the black market rose by 149% in 2019, according to researchers at Group-IB. ZDNet reports that the researchers tracked the pricing of 16,200 phishing kits by following ads on criminal forums, and found that the average cost reached $304 in 2019, compared to just $122 in 2018.

Phishing kits are applications that allow criminals to easily set up spoofed websites that automatically harvest credentials and send them to the attacker. Phishing kit developers usually offer a series of templates to spoof popular sites, as well as components to evade detection by security products.

Group-IB attributes the rise in prices to the fact that email security filters and other phishing defenses have grown more effective. As a result, phishing kit developers have needed to build more complex features to evade detection. More complexity means more work for the developers, which results in a higher-priced product.

The researchers believe another factor that’s driving prices up is that buyers themselves are gravitating toward more expensive phishing kits, since cheap kits have developed a well-deserved reputation for containing backdoors.

If this assessment is correct, then, as ZDNet puts it, “this is very good news.” Email security defenses are constantly working to make attackers’ jobs more difficult, and this trend indicates that their efforts are succeeding.

However, Group-IB also notes that the number of phishing kit sellers rose by 120% in 2019, and the number of phishing kits doubled. Most of these kits enabled the spoofing of login pages for Amazon, Google, Instagram, Office 365, and PayPal.

This also doesn’t mean criminals will stop trying to use phishing and other social engineering techniques to steal credentials or gain access to organizations’ networks. A price bump of under $200 isn’t likely to dissuade someone who’s serious about launching phishing campaigns.

Attackers will always be working to bypass security filters, and some phishing emails will always slip through the cracks. New-school security awareness training can complement your technical defenses by enabling your employees to recognize these emails.

ZDNet has the story: https://www.zdnet.com/article/phishing-kit-prices-skyrocketed-in-2019-by-149/