Olux Phishing Kit Targets Microsoft SharePoint Customers

Through our trust group partners, ZeroFOX Alpha Team has obtained a phishing kit targeting SharePoint customers. SharePoint is a Microsoft product that integrates with Microsoft Office, used for cloud-based hosting and sharing. The kit, called Olux, is available for purchase through a website set up for handling kit administrator-related tasks. The use of a custom website for kit sale operatons is relatively common - ZeroFOX also saw this with Cazanova Haxor kits previously discussed.

Recommendations

Whenever possible, enable multi-factor authentication. Ideally, this should be using an application such as Duo or Google Authenticator, as SMS codes can be intercepted
Always verify the sender of unexpected or suspicious emails
Never open attachments or click links in these emails
Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for these entities. Reach out to [email protected] for assistance, if needed

Details

Kit Mechanics

The Olux SharePoint kit is relatively simplistic. The landing page spoofs the legitimate SharePoint site fairly well, and claims that a potential victim must log in, in order to access some kind of document.

Figure 1. Olux Phishing kit landing page.

After a victim has submitted an email, the kit then requests the victim input their password twice. Finally, the user is redirected to a fake PDF loading page. Finally, after a few seconds of faked "loading," a message is displayed that the document is no longer available, and the victim is redirected to the legitimate Outlook Mail website. The images and other resources used in building the pages that are displayed to a potential victim are hosted on the domain ungeared-prevention.000webhostapp[.]com.

While the victim is inputting this information, it is aggregated and sent to an attacker-specified email address. This kit is simplistic, but likely to be affective due to the simplicity of it.

Kit Advertising, Sales, and Support

This kit is advertised on ICQ, Telegram, and also leverages a private Facebook group which has existed since November 2017. At present, this group has 258 members and remains active at the time of this posting. The site admins also advertise their Skype and Gmail accounts for support purposes.

Kit purchasers can use the admin website to submit support tickets, purchase and download updates to the kits, and access other resources. The site is also used to update kit users with a small news feed on the front page. Although this kind of service is not uncommon (similar features were present on the Cazanova Haxor kit admin site), what is unusual is the ability to purchase "Leads" and "Hosts" to use for scam activity. In particular, the Leads page is used to sell large groupings of email addresses, from various locations. Kit users are able to purchase dumps of anywhere from 10,000 to over 100,000 active email addresses.

Figure 2. Leads available for purchase as of 11/05.

Kit users also have the option of purchaing mailing programs from the site, and can even test these mailers by clicking a button to send the email associated with the users account a sample email.

For the scammer who is brand new to the scene, this kit even offers the "Olux Academy." For $250, new users will be given access to a "spamming torurial"[sic] with how-to videos and easy-to-use scripts. This appears to be done over an ICQ group.

Figure 3. Sample of "toturial"[sic] ICQ group offering, offered for $250.

Other Kit Offerings

In addition to the SharePoint phishing kit for which Alpha Team obtained kit code, Olux also offers many other kits targeting Discover, Office 365, Yahoo, Comcast Xfinity, and many others. The Discover kit phishes for account credentials, PII including social security number and date of birth, and credit card information. Other kits harvest user credentials for the targeted site.

Conclusion

The Olux phishing kit offerings are simple, but easy-to-use. Because of this, they are likely highly attractive to scammers, especially given that this group has been around since 2017. The level of support offered by the Olux group is high, even compared to other more boutique scam offerings Alpha Team has analyzed previously. ZeroFOX recommends implementing the recommendations above in order to reduce your risk of falling victim to these kinds of scams.

IOCs

angelsnatch[.]com
rockwool.vmwareidentity[.]edu
ungeared-prevention.000webhostapp[.]com

ThreatFeed Customers

Threat Feed Customers can access these indicators through the following cURL command:

curl -X GET --header 'Accept: application/json' --header 'Authorization: Token TOKEN' 'https://tg-api.zerofox.com/campaigns/111/list_indicators/