Free Phishing Kit Targets Snapchat Users

ZeroFOX Alpha Team has obtained a novel phishing kit that is freely available on hacking and leak forums. This phishing kit has been available since 28th February 2020 and targets the users of a highly-used multimedia messaging application, Snapchat.

Phishing could be defined as a fraudulent attempt to obtain sensitive information such as usernames, passwords, and other details by disguising oneself as a trustworthy entity in an electronic communication. In this particular case, the phishing kit exhibits a fake login page almost identical to the legitimate Snapchat login page, making it difficult for the potential victims to differentiate between the two.

Recommendations

Consider enabling multi-factor authentication for all accounts to prevent potential account takeover
Always verify the sender of suspicious or unexpected emails and messages
Never download attachments from unknown senders or suspicious emails
Consider enabling the compromised credentials rule for relevant entities. If needed, reach out to [email protected] for assistance
Consider enabling the domain monitoring rules and phishing rules to identify websites targeting your organization and entities

Details

A phishing site tries to steal user account passwords or other confidential information by tricking victims into believing that they are on a legitimate website. Users could even land on a phishing site by mistyping a URL, or by clicking a link in a malicious email or social media post. Likewise, this phishing kit aims to steal user login credentials which could further be used to perform various cyberattacks. The landing page of this phishing kit spoofs the legitimate Snapchat site quite well and prompts the user to enter their account details.

Figure 1. Snapchat Phishing Kit Landing Page.

Upon entering their login details, the victims are redirected to the original Snapchat page. The information entered by the user is dumped into a Login.php file which is configured in such a way that the credentials from the victims will be dumped into a username.txt file every time a new victim enters their credentials.

Figure 2. Login.php script, used to log victims’ usernames and passwords

Additionally, the IP address and user agent details of the victim are logged in another file called ip.txt.

Figure 3. Ip.php script, used to log victim IP address and User-Agent

This kit is available for free on a popular hacking forum. An associated Telegram group has existed since late February 2020. At present, this group has a following of nearly 4472 people on Telegram, with almost 1619 views specifically of the Snapchat phishing kit. The kit download page remains active at the time of this publication.

Figure 4. Telegram group for the hacking forum, advertising this Snapchat kit.

Conclusion

This Snapchat phishing kit is free and easy-to-use, making it accessible to a wide range of would-be attackers, especially given that the group has a considerable amount of followers. ZeroFOX recommends implementing the recommendations detailed above to reduce your risk of falling victim to these kinds of scams.