Alpha Team Research: Anatomy of an Instagram Phishing Page

In this post, Alpha Team will outline the anatomy of an interesting phishing page that was presented in a news story. Phishing and account takeover are common attacks issued against users of this social network due to the low technical requirements to execute them, as well as the payoff of selling accounts to the highest bidder, especially if the victim account is verified or has an "OG" username (an attractive username). The linked story does a good job of presenting details of the scam at a high level, but Alpha Team found the phishing page and uncovered potential infrastructure behind it and has found potentially 56 other pages on different domains using the same kit.

Recommendations

Enable multi-factor authentication for all accounts to prevent potential account takeover
Always verify the sender of suspicious or unexpected emails
Never download attachments from unknown senders or suspicious email
Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for those entities. Reach out to [email protected] for assistance, if needed

Details

The blog post went into detail about the attack. A victim receives a phishing email with a "call to action" threatening the victim to verify credentials before their Instagram account is banned for copyright infringement. Call to actions are a common theme in most phishing , malware and BEC emails as it preys on the victim's sense of urgency to respond to the e-mail. Once visited, the victim is presented with a web page:

Phishing Page1

Courtesy of SophosNews

The call to action is presented directly to the victim, and the next page includes a login form for username, password and date of birth entries. Once entered, the victim is redirected to legitimate Instagram website, and their credentials are compromised. Although the news story redacts the URL, Alpha Team used its domain data sources to find the website located at:

https[://]instagram.copyrightinfringementappeal[.]celalx.cf/form/2957140528103/

By viewing the network transactions when loading the page, as well as the inspection source, one can see how the phishing kit works, as well as find any unique artifacts that can help identify the kit in the future. For example,vy-MhgbfL4v.html was a unique page name listed in the HTML, with the full element being listed below:

c5%9eifreyi%20Yenile%20%e2%80%a2%20Instagram_files/vy-MhgbfL4v.html

Pivoting on this page in our private data sources as well as public data sources yielded a number of potential kits, listed below:

http://help.instagram.com.fromfacebook.ml
http://instagramhelpsupport.org/11581030/support/confirm/iamliamneesoniwillfindyouandiwillkillyou
http://instagramhelpsupport.org/11581030/support/confirm/insertscammedaccounthere
http://www.help.instagram.com.fromfacebook.ml
http://www.instagram.com.center-help.tk
https://account-netflix.cf/confirmation.com/
https://center-instagramhelp.tk
https://copyright-helpinstagramcenter.ml
https://copyright-instagramagency-helpmedia.ml
https://copyright-instagramsupport.ml
https://copyrightinstagramsupportcenter.cf
https://helpinstagramcopyright.tk
https://instagram-secure.stats10.com
https://instagram.copyrightinfringementappeal.celalx.cf/form/2957140528103/
https://instagram.stats10.com
https://instagramcopyright-infrigement.tk
https://instagramhelpcenter-verifybadge.ml
https://teaminstagrams.cf
https://www.abbccomunicacao.com.br/lucianohuck/
https://www.center-instagramhelp.tk
https://www.facebook.pro.tc
https://www.instagram-copyrigthservices.com
https://www.instagram-help-accounts.com
https://www.instagram-shortener.gq
https://www.instagram-violationreview.ml/confirm/
https://www.instagram.com.copyright.appeal.cf
https://www.instagram.com.fromfacebook.ml
https://www.instagram.com.infocopyright.cf
https://www.instagram.helpingservices.tk
https://www.instagramforcopyright.kallicho.ml
https://www.instagramsupportcopyright.cf
https://www.netflixfirsati.cf
https://www.web-instagrams.com

There are variants in this list of Instagram, Facebook as well as a list of risky, potentially phishing style words like "copyright", "helpcenter", "confirmation" and "violation".