CIO News Hubb
Advertisement
  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact
No Result
View All Result
  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact
No Result
View All Result
CIO News Hubb
No Result
View All Result
Home Information Security

New Phishing-as-a-Service Platform Lets Cybercriminals Generate Convincing Phishing Pages

admin by admin
May 14, 2023
in Information Security


May 13, 2023Ravie Lakshmanan

A new phishing-as-a-service (PhaaS or PaaS) platform named Greatness has been leveraged by cybercriminals to target business users of the Microsoft 365 cloud service since at least mid-2022, effectively lowering the bar to entry for phishing attacks.

“Greatness, for now, is only focused on Microsoft 365 phishing pages, providing its affiliates with an attachment and link builder that creates highly convincing decoy and login pages,” Cisco Talos researcher Tiago Pereira said.

“It contains features such as having the victim’s email address pre-filled and displaying their appropriate company logo and background image, extracted from the target organization’s real Microsoft 365 login page.”

Campaigns involving Greatness have mainly manufacturing, health care, and technology entities located in the U.S., the U.K., Australia, South Africa, and Canada, with a spike in activity detected in December 2022 and March 2023.

Cybersecurity

Phishing kits like Greatness offer threat actors, rookies or otherwise, a cost-effective and scalable one-stop shop, making it possible to design convincing login pages associated with various online services and bypass two-factor authentication (2FA) protections.

Specifically, the authentic-looking decoy pages function as a reverse proxy to harvest credentials and time-based one-time passwords (TOTPs) entered by the victims.

phishing-as-a-service

Attack chains begin with malicious emails containing an HTML attachment, which, upon opening, executes obfuscated JavaScript code that redirects the user to a landing page with the recipient’s email address already pre-filled and prompts for their password and MFA code.

The entered credentials and tokens are subsequently forwarded to the affiliate’s Telegram channel for obtaining unauthorized access to the accounts in question.

The AiTM phishing kit also comes with an administration panel that enables the affiliate to configure the Telegram bot, keep track of stolen information, and even build booby-trapped attachments or links.

UPCOMING WEBINAR

Learn to Stop Ransomware with Real-Time Protection

Join our webinar and learn how to stop ransomware attacks in their tracks with real-time MFA and service account protection.

Save My Seat!

What’s more, each affiliate is expected to have a valid API key in order to be able to load the phishing page. The API key also prevents unwanted IP addresses from viewing the phishing page and facilitates behind-the-scenes communication with the actual Microsoft 365 login page by posing as the victim.

phishing-as-a-service

“Working together, the phishing kit and the API perform a ‘man-in-the-middle’ attack, requesting information from the victim that the API will then submit to the legitimate login page in real time,” Pereira said.

“This allows the PaaS affiliate to steal usernames and passwords, along with the authenticated session cookies if the victim uses MFA.”

The findings come as Microsoft has begun enforcing number matching in Microsoft Authenticator push notifications as of May 8, 2023, to improve 2FA protections and fend off prompt bombing attacks.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.





Source link

Tags: computer securitycyber attackscyber newscyber security newscyber security news todaycyber security updatescyber updatesdata breachhacker newshacking newshow to hackinformation securitynetwork securityransomware malwaresoftware vulnerabilitythe hacker news
Previous Post

Prepare for Debate and Seek Decision

Next Post

Initiative ~ Future of CIO

Related Posts

Information Security

New BrutePrint Attack Lets Attackers Unlock Smartphones with Fingerprint Brute-Force

by admin
May 30, 2023
Information Security

Advice to SMB CEOs from a former CIO

by admin
May 30, 2023
Information Security

Critical OAuth Vulnerability in Expo Framework Allows Account Hijacking

by admin
May 29, 2023
Information Security

New Stealthy Bandit Stealer Targeting Web Browsers and Cryptocurrency Wallets

by admin
May 28, 2023
Information Security

Severe Flaw in Google Cloud’s Cloud SQL Service Exposed Confidential Data

by admin
May 27, 2023
Next Post

Initiative ~ Future of CIO

Recommended

Illustratereinvention ~ Future of CIO

May 30, 2023

New BrutePrint Attack Lets Attackers Unlock Smartphones with Fingerprint Brute-Force

May 30, 2023

Advice to SMB CEOs from a former CIO

May 30, 2023

Innovation & Information ~ Future of CIO

May 29, 2023

Critical OAuth Vulnerability in Expo Framework Allows Account Hijacking

May 29, 2023

Innovativegrowth ~ Future of CIO

May 28, 2023

© CIO News Hubb All rights reserved.

Use of these names, logos, and brands does not imply endorsement unless specified. By using this site, you agree to the Privacy Policy and Terms & Conditions.

Navigate Site

  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact

Newsletter Sign Up

No Result
View All Result
  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact

© 2022 CIO News Hubb All rights reserved.