Alpha Team Research: Cazanova Haxor Update

As previously reported, ZeroFOX has been tracking a phishing kit author going by the moniker Cazanova Haxor. One of these kits, dubbed Adrenaline, targets Paypal customers. ZeroFOX Alpha Team has obtained a copy of this phishing kit.

Recommendations

Whenever possible, enable multi-factor authentication. Ideally, this should be using an application such as Duo or Google Authenticator, as SMS codes can be intercepted
Always verify the sender of unexpected or suspicious emails
Never open attachments or click links in these emails
Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for these entities. Reach out to [email protected] for assistance, if needed

Details

Phishing kits often spoof financial organizations because the credentials associated with these types of organizations are the most valuable. If an attacker can obtain PayPal credentials, these credentials can be used to transfer money from victims to attacker-controlled accounts, or to make online purchases.

Historically, this threat actor has offered a PayPal kit since 2017. This kit was initially marketed and sold under the name zPaypal. However, in late June 2019, this kit was rebranded as “Adrenaline” to fit with the rest of the actor’s drug-based naming scheme.

Figure 1.

Figure 1. Login dashboard of the original zPayPal kit.

The newest iteration of Adrenaline is more sophisticated than the average kit. The landing pages are indistinguishable from the actual PayPal website, making it difficult for users to realize they are not interacting with the legitimate site. The kit requests information ranging from credit card information to billing address to driver’s license information, to mother’s maiden name and social security number.

Figure 2.

Figure 2. One landing page of Adrenaline kit, requesting visitors confirm their billing address.

As with all Cazanova kits, this kit is purchased through a central purchasing site and is available for $99 USD. The kit was advertised for a period of two years on the Facebook page, Cazanova Haxor Store. This page has since been taken down in a coordinated effort between ZeroFOX and Facebook. After successful takedown of this site, this actor appears to have ceased operations on Facebook. At present, ZeroFOX has been unable to identify any additional pages being used by Cazanova. A blurb posted on the website used for license purchase and management now informs kit users that the group has been moved to Telegram. This seems to be a trend in kit and tool sales - as the social networks crack down on this kind of activity on their platforms, actors are moving to more covert channels.

The kit we obtained includes functionality to automatically report new credentials received to attackers via email. After receiving the kit, purchasers must change the reporting email address within the /V2/inc/config.php file. Additionally, credentials are logged locally in a results file at /result/Re3sult.txt. All victim-entered credentials are verified using a series of scripts that verify length and pattern of entered text.

Conclusion

Phishing kits have been around a long time - and aren't going anywhere any time soon. Financial Services organizations like PayPal are highly attractve targets for scammers given the high reward. The trend of moving towards more covert communiciation channels like Telegram or Discord, versus public social media platforms, is also interesting to note. ZeroFOX recommends applying the recommendations listed above in order to protect your organization from this threat, as well as other phishing campaigns.