How to Identify a Phishing Kit

Over the last several months, ZeroFOX Alpha Team has reported on a variety of different phishing kits targeting major organizations. These targets are from diverse verticals. Some are within the Financial Services sector, while others are email services or cloud hosting platforms..

Often, the landing pages of these scams are nearly identical to the real thing, making it difficult for potential victims to distinguish between the two. This post takes a look at the landing pages of several different phishing kits, and seeks to give readers a better understanding of how they can identify a scam.

Recommendations

Verify the URL of any website where you input credentials, prior to submitting them. Ensure that the URL matches what you would expect. Attackers use many strategies to disguise their malicious URLs, including using very long URLs where the beginning contains keywords related to the legitimate site, or using shortened links that conceal the real URL
Never click a link from a suspicious email, or one from an unknown sender
Whenever possible, enable multi-factor authentication. Ideally, this should be using an application such as Duo or Google Authenticator, as SMS codes can be intercepted
Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for these entities. Reach out to [email protected] for assistance, if needed

Details

Olux Targets SharePoint Customers

Yesterday, Alpha Team posted an analysis of the Olux SharePoint phishing kit. This kit seeks to steal email credentials from its victims. The landing page for this kit at first glance, is a pretty good copy of the legitimate service’s page. The scammer has used the real SharePoint logo, and has also included the logos of other Microsoft Office products in order to make themselves seem more credible.

However, a closer look at the language on this page indicates that this is an imitation - not the real thing. Several phrases use odd language and capitalization, like “Put Email to access document…” and “No account? Create sharepoint!” Neither of these phrases use natural language, and multiple errors are present.

Figure 1. Olux SharePoint kit landing page.

Cazanova Haxor Targets Netflix, Paypal, and more

Although the landing page for the Olux kit has some glaring errors that make it suspicious, some phishing kit developers are more sophisticated, to the point where it becomes difficult to discern what is fake and what is real. For example, the scam page for the Cazanova Netflix kit is shown below.

Figure 2. Scam page of Cazanova Haxor’s Netflix kit

The branding used on this page is an excellent impersonation of Netflix’s official branding and there are also no obvious spelling or grammar mistakes. This makes it much more difficult to tell that this is a phishing page unless you are paying very close attention. Because the phishing kit branding spoofs Netflix so well, it becomes very important to verify the URL of the page. Is the web address something that would be expected, like netflix.com/verify? Or is it something new and likely suspicious, like netflix-verify-438u5lk34235gdfhd87fgd.xyz? If the latter is the case, it’s likely not safe to be submitting personal information to the page.

Conclusion

Although some phishing scams are obvious, many phishing kit authors have become highly sophisticated in the graphic design of their kits. By expertly mimicking the branding of their targeted organization, phishing kit authors are able to trick their victims into submitting personal, or even credit card information, without realizing they have been scammed. Being vigilant and applying the recommendations mentioned above will help readers to remain safe from phishing scams and potential account compromise.