HiPro: Analysis of a Phishing Kit targeting Apple

HiPro is a prolific and elusive phishing kit from a group called Hijaiyh that is used to steal credentials and financial data of customers from a number of brands. The kit authors and operators are based out of South East Asia. It is hard to find HiPro kits due to a feature within the kit to self delete itself once deployed. Recently, Alpha Team obtained a fresh copy of HiPro targeting Apple. Phishing Kits targeting Apple are often used to obtain Apple ID as well as credit card information to commit fraud, utilising fake login pages and messages to create a sense of urgency of action from the potential victim. This phishing kit utilises bot/crawler detection mechanisms to avoid detection as well as its own dedicated API endpoints, and command line tool for deploying the kit. The increased complexity of this new kit evidences considerable time and resources are being put into creating them, and that production and distribution is still profitable for threat actors which further incentivises the authors to add more targets.

Recommendations

Where possible, use conditional or risk based access policies to restrict MFA authentication to specific geo-locations
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
Always verify the sender of suspicious or unexpected emails and messages
Never download attachments from unknown senders or suspicious emails
Never click on links or enter credentials when prompted unless you have checked the URL and purpose of the request is legitimate
Reach out to your ZeroFOX account manager or [email protected] if you need help setting up monitoring, configuration or want more information about the associated website

Details

HiPro is a new kit authored by the same individual (under the alias of jstxx) which previously sold phishing kits titled “Hijaiyh.” Hijaiyh was sold and distributed up until early-mid 2020 at which point the authors closed their online shop and foreshadowed the release of their new kit, Hijaiyh:Pro.

Alpha Team located the new storefront for the authors of HiPro. This is where threat actors which have purchased the kit can log in to administer their deployment, or new customers can register to buy kits along with an invite code.

Figure 1: The new Hi:Pro store front

Figure 2: HiPro “ToS”

The kit contains a handful of directories and a PHP file within the root directory called “holla.” This PHP file is a command line tool for HiPro deployments, providing options to deploy the kit, view configuration, remove all traces of it from a host, upload files or even passing commands directly to the system shell such as bash.

Figure 3: “holla” CLI

HiPro loads its configuration details from the file “HiSys/config/hiconfig.ini”. The configuration options include the targeted brand, version, HiPro API servers and the mode of deployment.

Figure 4: HiPro kit configuration file

As evidenced within the source code of the kit, current targets appear to be Amazon, Apple and Spotify, with this particular kit targeting Apple.

Figure 5: Code showing current target options for Amazon, Apple and Spotify

The kit contains several PHP files with API calls to verify whether visitors are human and not automated scanners. This is done to reduce the likelihood of detection and subsequent takedown of the domain.

Figure 6: Excerpt from PHP file responsible for detecting and blocking bots or scanners

For the operator of the kit, there is an administrative panel which can be accessed via a specific URL. The panel has a login page that prompts for the operator’s HiPro store email and password in order to confirm the deployment is licensed by HiPro. Once logged in, operators can view a dashboard of the deployment along with statistics on visitors and victims.

Figure 7: HiPro admin panel login screen

Figure 8: Admin dashboard showing statistics of the deployment

The administrative panel allows actors to view victim logs, blocked IP addresses, hostnames, and user agents, as well as view their phishing site in a testing mode.

Victim workflow

When potential victims visit the site, they must both pass antibot checks which block IP addresses or user agents associated with bots/crawlers, as well as provide a specific parameter in the URL which the operator of the kit configures (e.g. hxxps://example[.]com/?signin). If these checks are passed the potential victim is presented with an identical copy of Apple’s own login portal.

Figure 9: HiPro Apple victim login portal

The first step of the phish requires site visitors to enter their Apple email address and corresponding password to proceed to the next page. If the visitor enters their credentials to the login prompt, their username and password are emailed directly to a dropper address configured by the threat actor operating the kit.

Figure 10: Code responsible for sending mail to dropper email address

The victim is then prompted with a fake security warning.

Figure 11: Possible warning messages the victim can receive after entering credentials

The next step requires the victim to enter a large amount of sensitive information including:

Full name
Date of birth
Phone number
Address
Credit card number
Expiry information and security code

Figure 12: Phishing page requested further PII and card details

The kit also performs localisation of verbiage based on the location of the victim. For example, site visitors from the United States, Switzerland, and Canada are required to provide their social security number in order to proceed to the next step in the victim workflow.

Figure 13: Possible wording based on visitors geographical location

If the victim clicks continue, their submitted details are checked against various APIs to ensure the card details are correct. If not, they are asked to confirm details again. If these checks pass, the data is collated and emailed to the dropper address.

Figure 14: Sample output of the email content sent to the dropper email address

The victim is then informed their “verification” is complete, before being redirected to the legitimate Apple ID login portal.

Figure 15: Final page presented to the victim before being redirected to a legitimate Apple domain

Conclusion

Phishing is a serious threat and phishing kit operators and authors are deploying new tactics to steal sensitive financial and personal information from unsuspecting victims. HiPro is currently sold and distributed via a closed marketplace. However, based on the popularity of Hijaiyh’s previous project, Alpha Team assesses with HIGH confidence that previous customers will convert to the new kit and distribution will increase over the coming months. ZeroFOX recommends implementing the recommendations detailed above to reduce your risk of falling victim to these kinds of cyberattacks.