A sophisticated phishing toolkit dubbed NakedPages has been put up for sale on cybercrime forums. The toolkit is being sold via a PHP-based phishing app with the same name and claims to be effective for phishing entities like Google and Microsoft Office.
Functionality of NakedPages
- According to CloudSEK, the NakedPages toolkit is also being advertised on a few Telegram channels.
- As the toolkit is designed to work on Linux, it requests for read, write, and execute permissions from the ‘user’ and further requests for read and execute permissions from both ‘group’ and ‘others.’
- The toolkit is fully automated and comes preloaded with more than 50 phishing templates and site projects.
- It has fully-integrated and battle-based anti-bot functionality and detects bots of all kinds from over 120 countries.
- It allows threat actors to manually receive results, decode responses, add cookies, and filter users from the user Js config.
What does this indicate?
While the NakedPages phishing toolkit is new in the cybercrime forum, there are reports suggesting the explosion in the use of phishing toolkits. Phishing kits give threat actors the ability to deploy effective phishing pages regardless of their skill level.
In January, researchers discovered over 1200 Man-in-the-Middle phishing toolkits in the wild. These kits were primarily used to perform high-quality phishing pages which impersonate major online banking, e-commerce, popular retailers, and online services to steal customer data.
Another notable point
- With cryptocurrency becoming popular among users, ProofPoint researchers have observed a rise in the use of phishing kits to steal cryptocurrency and harvest credentials from a variety of cryptocurrency-related wallets and sites.
- One kit that is used in the wild for this purpose is ‘BulletProfitLink’. It offers threat actors the ability to spoof different brands such as blockchain[.]com. It can also spoof NFT and other cryptocurrency wallet service providers.
Conclusion
The use of phishing toolkits is getting more widespread and popular among financially-motivated cybercriminal groups. These toolkits are easy-to-use and most of them are available free of cost. Given the rise in such threats, the protection of digital identity and personal data become one of the top key priorities for online safety.
Publisher
/https://cyware-ent.s3.amazonaws.com/image_bank/f3d4_shutterstock_293166725.jpeg)
/https://cyware-ent.s3.amazonaws.com/image_bank/a7a4_shutterstock_750383548.jpg)
