@BushidoToken Threat Intel

For the last three months I have personally received the same phishing email masquerading as a PayPal 'your account has been suspended' notification, trying to steal my login credentials: The email arrives from "service@paypal.com" and looks very convincing for the average user.  Here is the current phishing chain the threat actors are currently using in these types of attacks: Fortunately, there are several steps involved in this attack. Hopefully this will give unsuspecting users more of a chance to recognise they are being targeted. Flow of the phishing chain (NB the credential harvesting page is replace with the YouTube video): The interesting part of this attack to me, is that it leveraged one of MySpace's domains to redirect users to the next stage. However, if you try to visit one of the links - without clicking on the button in the URL - it will redirect you to the same YouTube video. Example YouTube comment from these videos: Interestingly, I also used UR...

  I recently uncovered a phishing command and control (C&C) Simple Mail Transer Protocol (SMTP) server hosted on the same page that the kit was deployed on. Surprise surprise, they were targeting PayPal. The Leaf PHP Mailer: The phishing page has all the features you would largely expect to see of a phishing C&C. The main features the attackers require is a way to send out hundreds, if not thousands, of fake emails maquerading as a service such as PayPal to a long list of target email address. Other features the Leaf PHP mailer also offers includes adding HTML code to the phishing email.  Blacklist checker: The blacklist checker enables the phisher to check whether their host is blocked by spam lists and to maintain a record of how likely their phishing emails are likely to land in inboxes. Once an IP address appears on too many list, the operator can transfer to a new host and start the process again.  The CAPTCHA: Nowadays, a large number of credential harvestin...

I was recently introduced to this nice feature of urlscan.io which lets you search phishing pages via image hashes. I quickly realised how this could be a powerful tool.  A hash, by definition, is the unique numerical fingerpint made of the total sum of a file's components. Hashing a file includes using an algorithm that calculates a unique fixed-size bit string value from the file. It was then shown to me that you could take the file hash of an image from a website and then use it to find all websites that contain the same hash and image.  Most phisherman are lazy and will just steal the contents of an entire website, clone it, and host it on their own server to begin harvesting credentials from unsuspecting victims. I decided to test how useful this feature was from a site (gov.uk) that is often used to scam victims out of their payment details, personally identifiable information (PII), and other sensitive data. I chose to use the logo from the si...