Hijalyh Phishing Kit Targets Apple Customers

The Hijalyh Phishing Kit has been available to the scam community since 2018, and targets Apple and Amazon customers. Although early versions of the kit were rudimentary and easily identified as scams, recent kit development has made the scam pages much more believable. ZeroFOX Alpha Team has obtained copies of the Apple version of the kit and has analyzed the kit for this blog post.

Recommendations

Whenever possible, enable multi-factor authentication. Ideally, this should be using an application such as Duo or Google Authenticator, as SMS codes can be intercepted
Always verify the sender of unexpected or suspicious emails
Never open attachments or click links in these emails
Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for these entities. Reach out to [email protected] for assistance, if needed

Details

The Hijalyh, also known as Hijayah, Hijalyh:Re, and Hijalyh Reborn, phishing kit targets Apple and Amazon customers, and has been on the phishing-as-a-service scene since 2018. Kit administration is done on a central domain, hijaiyh[.]me. Recently, the developer of Hijalyh has partnered with both antipot[.]pw, allowing phishing kit users to better block researchers from accessing and blocking their scams, as well as KuzuluyArt, another phishing kit group that targets PayPal. ZeroFOX Alpha Team has obtained and analyzed multiple versions of the Hijayah kits targeting Apple customers.

Figure 1. Landing page of kit admin site, advertising new partnerships

Features and language support

The kit offers antibot and anti-analysis capabilities and blocks a number of IP ranges associated with security research organizations. It also blocks AWS IPs, used by many research teams to access these sites without compromising their organization’s environment, as well as specific User-Agents and hostnames.

Initially, in versions 1 and 2, Hijalyh offered only English, Japanese, and Indonesian language support, however, in the most recent version (4.1, released late November 2019), this has expanded to include support for Spanish, German, French, Dutch, Thai, and Chinese.

Figure 2. Kit landing page of the Indonesian version

Hijalyh requests that potential victims submit identifying information in order to verify their identity so that they can reclaim their Apple ID. The requested information is tailored according to the location of the visitor of the phishing site - for example, US visitors are asked for Social Security numbers, while visitors from Canada are asked for a Social Insurance Number. Requested information includes the identifying number used by the victim’s local government, a selfie photo of the victim holding an ID card, images of the front and back of an ID card, and credit card information.

Kit pricing and sales

Early versions of the kit were sold for $30, however, the recent improvements to the kit have been used to justify selling the kit at a higher price. Currently, the kit is sold for $90. This includes updates to the kit, as well as support and the ability to request features. This kind of customer service offering has become common for phishing kits, as the market has become more saturated with offerings.

Figure 3. Membership requirements and offerings

Conclusion

Recent improvements to the Hijalyh phishing kits have made them much more sophisticated than the early versions of the kit. As we’ve seen with other phishing kit offerings, the trend of scammers requesting selfies of victims is present here as well. Phishing continues to be a popular attack vector given its high level of reward for minimal effort, and the increasing availability of ready-to-go phishing kits lowers the barrier to entry so drastically that it is basically non-existent. Because of this, the pool of would-be attackers is even greater than it has been in the past, and it is likely that we will continue to see a surge in attacks leveraging these kits.