Phishing Kits

Let's make a phishing attack (just kidding). The easiest way to do so is obtaining a pre-made phishing kit. Phishing kits represent a significant and growing danger. These tools, readily available in the darker corners of the internet, empower even technically unsophisticated criminals to launch effective phishing campaigns. This post aims to demystify phishing kits, explore their dangers, and provide practical advice on safeguarding against these insidious threats. 

Phishing kits are pre-packaged sets of tools and resources designed to facilitate phishing attacks. The parts of a phishing kit can be broken down into the following components:

• Email templates
• Webpage clones (usually scraped from the legit site)
• Scripts and code repositories 
• Hosting Platforms
• Delivery Systems
• Readme & docs
• Premium services
• Real-time data analysis tools
• Customer service*
• Social engineering tools
  

These kits are designed for ease of use, allowing attackers to launch phishing campaigns with minimal technical know-how. As discussed in one of my previous talks, there is an entire economy around phishing kits. Some of them even have customer service after the purchase of the kits to provide assistance. This leads to why phishing kits are used in the first place. 

They are easy to use, with the documents and support, there are very few technical skills required to buy a kit. The hardest part is probably finding the kit, the rest is mostly setup for you. The kits also have a high return on investment. They are cheap and with only a few responses have paid for themselves. With a mass produced attack, using these kits makes it harder to trace the attacks back to fraudster (yes I said that unironically).

Phishing kits are dangerous for several reasons. They are widely available, and easily purchased, malicious actors can easily obtain these kits from marketplaces. Modern kits are increasingly sophisticated, making them hard to distinguish from legitimate sources. Additionally, they are pretty easy to get. You can find them on Dark Web Marketplaces: these hidden online platforms offer a variety of kits for sale. They are sold in-person or on peer-to-peer networks. They are shared among fraudster circles. Someone needs to make the secret sauce, so some opt to create their own using online tutorials (a risky and less favored approach).

Once the phishing kits is bought, the next steps include
 

1. Set up phishing page: These attacks are typically hosted on compromised servers or through anonymizing services. It's not useful to buy premium hosting, as the hosting provider will know your identity and quickly terminate the attack. Then the page needs to be customized to better trick the victim. Customizing the attack may allow specific brands to have their look and feel on the page.
   
2. Send email campaigns: The mass emails are sent, luring victims to the phishing page. The attacker's kit will hopefully have some spam filter evasion techniques to bypass filters and actually reach your mailbox. This is why some scam emails have strange characters in replace of typical letters to defeat keyword detection in subject lines that may be fraudulent. 
3. Launch the attack: Ensure the phishing websites is live and capturing data. The data should be sent to the drop site, which may be a form, email inbox, or separate webshell.
   
4. Data collection & pharming: When victims enter their information, it's captured and sent to the attackers. Stolen information is either used for further attacks or sold on other marketplaces.
5. Clean-up: Remove traces of activity from hosting services, especially if they are on compromised services. From the start it'll help if VPNs and/or proxy servers are used to mask the original attack. Then logs are also cleared from relevant systems that the attacker has access to, such as destroying and creating new webshells.
   

It's rare that the person who creates the kit is also the same person who uses it, and the person who uses the stolen data. Using your own stuff creates a high risk of exposure, more legal ramifications, and higher risk. 

Also, it requires some amount of skill to pharm-to-table these attacks, and typically people stick to their skills; either building, buying, hosting, selling, pharming the data. By selling these kits, creators can earn consistent income with lower risk compared to using the kits themselves. The demand for easy kits are high, making the sale of phishing kits a lucrative business and a more consistent form of income than trying to hope your phishing site works. 

The kits are so easy, that they sometimes also attack their buyer and steal their information, because attackers are gonna attack. Engaging in phishing using their own widely sold kits could mean the creators risk falling victim to security measures that have adapted to their own tools. The phishing landscape is highly competitive, with many players. Creators might prefer to avoid direct competition in this crowded field. Sellers make their money by selling these kits while staying well-hidden to dodge legal trouble. Recognizing their methods is key in crafting effective cybersecurity defenses. It's all about understanding the entire phishing landscape, not just the threats themselves, to stay one step ahead.

 Kits are pretty easy to use, cheap, have a high ROI, and are an easy starter for the beginning fraudster. Don't do kits, kids.