ZeroFox Intelligence Flash Report - Advertised Malicious Tool Targets Gmail Accounts

In this Flash Report, ZeroFox researchers report on a malicious tool that targets Gmail accounts, recently announced in the dark web forum Exploit.

Standing Intelligence Requirements

Deep Dark Web and Criminal Underground DDW

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

View the full report here

On May 20, 2024, untested actor “Plifal” announced a new malicious tool named Plifal Software on the Russian-speaking dark web forum Exploit. The tool allegedly bypasses Google application programming interfaces (APIs) and policies, enabling threat actors to exploit session cookies and illicitly access Gmail user accounts.
The advertisement garnered positive feedback from the Exploit community. On June 1, 2024, actor “vasiliev84” claimed that the software had operated as expected, stating that the product is a “game changer” and recommending it to fellow threat actors.
While the advertisement offers no further detail surrounding the capabilities of Plifal Software, illicit access to an individual or business Gmail account can enable a threat actor to conduct a myriad of malicious activities.
Software tools targeting widespread and diverse software solutions that are becoming increasingly prominent in the workplace are almost certainly a coveted target for threat actors seeking to gain illicit access and conduct subsequent malicious activity.