Popular Phishing Kit Pivots to Target Trading Platforms

ZeroFox has observed a recent trend in phishing kits adding new targets to their offerings, consisting of stock trading and cryptocurrency platforms. The “phishing-as-a-service” kit known as FreakzBrothers has recently added such a target to their store targeting Robinhood, a popular stock trading platform. Copies of these phishing kits were obtained shortly after deployments began and analyzed.

Standing Intelligence Requirements

PII & Fraud Brand For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
Always verify the sender of suspicious or unexpected emails and messages
Never download attachments from unknown senders or suspicious emails
Never click on links or enter credentials when prompted unless you have checked the URL and purpose of the request is legitimate
Reach out to your ZeroFox account manager or [email protected] if you need help setting up monitoring, configuration or want more information about the associated website

Details

FreakzBrothers is the name of a popular commercial phishing kit which can be obtained from a private marketplace, operated by the authors. During the course of its development over the past several years, targets have consisted of well-known retail brands. With the recent popularity of stock trading applications such as Robinhood, brand new versions of the phishing kit have been released targeting these brands, as well as including new capabilities and a refactored code base.

Figure 1: Phishing page impersonating Robinhood login portal

Figure 2: Phishing page verification process screen

Through the “verification” process, victims are prompted to provide input for their:

Email address
Full name
Date of birth
Social security number
Full residential address
Bank name
Bank user id
Bank password
PIN number

Depending on the email address provided, the victim may also be redirected to a page imitating their consumer email provider's login screen. This is used to gather the victims email password along with other information.

The final stage requires the victim to upload identification documents, namely a photo of their drivers license.

Figure 3: The victim is prompted to upload photos of their identity documents

At each stage of the victim workflow, data is sent via email to the owner of the deployment. The dropper email address is configured via the FreakzBrothers store after purchasing the phishing kit.

Figure 4: Example email content sent to the configured dropper email address

Similarly to other popular commercial phishing kits, the phishing page deployment can be monitored or managed by a separate administrative dashboard. This page contains metrics for the operator, keeping track of the number of visitors, blocked bots, and victims.

Figure 5: Administrative dashboard of the phishing kit

A new technique being used by these kits is the use of an API specifically designed for remote administration and verification of deployments, run by the authors of FreakzBrothers. This API has multiple endpoints allowing for multiple functions:

Verifying credentials for the admin dashboard
Recording visitor information
Logging blocked IP addresses
Retrieving configuration data
Verifying the domain

Several kits ZeroFox has analyzed also contain code which are disguised as functions to “verify” victim data, but instead simply sends victim information and credit card data directly to the authors of FreakzBrothers.

Figure 6: Function which sends full user and credit card information ($copy) to the API, after emailing victim data to the owner of the deployment.

The addition of trading platforms to popular phishing kit providers shows authors are continuing to adapt and produce new content based on demand and current trends. Due to the nature of phishing kits and how they are distributed, ZeroFox assesses with high confidence that similar offerings will continue to appear, as well as “cracked” or edited versions of popular kits, such a FreakzBrothers.