![\"Combosquatting:](\"https:\/\/media.kasperskycontenthub.com\/wp-content\/uploads\/sites\/43\/2022\/03\/21114922\/Phishkit_market_01.png\")
<\/a><\/p>\nCombosquatting: registering a fake website with a domain name which contains “facebook.com”<\/em><\/strong><\/p>\n Given phishing websites can be efficiently blocked or added to anti-phishing databases, cybercriminals have to generate these pages quickly and in large numbers. Creating them from scratch over and over again is time-consuming, and not all cybercriminals have the web-development and administration skills it takes. That is why cybercriminals favor phishing kits, which are like model aircraft or vehicle assembly kits. They consist of ready-made templates and scripts which can be used to create phishing pages quickly and on a massive scale. Phishing kits are fairly easy to use, which is why even inexperienced attackers who do not have any technical skills can get their heads around them.<\/p>\n Cybercriminals tend to use hacked official websites to host pages generated using the phishing kits or rely on companies which offer free web-hosting providers. The latter are constantly working to combat phishing and block the fake pages, although phishing websites often manage to serve the intended purpose within their short period of activity<\/a>, which is to collect and send personal data of victims to criminals.<\/p>\n Phishing kits are ready-to-deploy packages which require the bare minimum effort to use. Moreover, their developers usually provide instructions with their products for inexperienced attackers. Phishing kits usually are designed to generate copies of websites representing famous brands with large audiences. After all, the more potential victims there are, the more money there is to be stolen. The phishing kits we detected in 2021 most frequently created copies of Facebook, the Dutch banking group ING, the German bank Sparkasse, as well as Adidas and Amazon.<\/p>\n The most basic option phishing kits offer is a ready-made phishing page which is fairly simple to upload on a web-hosting service.<\/p>\n Contents of simple phishing-kit archive<\/em><\/strong><\/p>\n These phishing kits have two essential components for practical reasons:<\/p>\n Telegram bot token in a phishing kit’s code<\/em><\/strong><\/p>\n Instead of providing ready-to-load pages, more sophisticated phishing kits contain their elements (images, forms, phishing script, text fragments etc.), along with a separate script which creates new pages from these elements.<\/p>\n Contents of a phishing-kit archive: phishing pages created automatically when index.php file is run<\/em><\/strong><\/p>\n There are also advanced phishing packages which not only come with all the tools and elements needed to assemble the web pages, but also include a control center with a user interface. Attackers can use this control center to tailor how a phishing page functions, e.g., by specifying how they would like to receive stolen data. Some sophisticated phishing kits allow to generate pages which target users from different countries using a built-in dictionary containing the same phrases in different languages.<\/p>\n Dictionary from an advanced phishing kit<\/em><\/strong><\/p>\n In addition to tools for attackers to create phishing pages themselves, some phishing kits can include scripts for sending out messages to potential victims via popular messaging apps or e-mail which contain links to phishing pages. These mailings tend to be the go-to channel cybercriminals use to get their pages out there. The contact details of potential victims can be found on the dark web, where a colossal amount of databases are sold which detail clients of various companies and services.<\/p>\n Many of the scripts for sending out messages included in phishing kits or sold separately can add a URL parameter in the links which contains the recipient’s e-mail address. This parameter is used extensively in corporate phishing attacks. Some known phishing kits which target the corporate sector are able to capture the e-mail domain located in the URL parameter and generate a phishing page tailored to this domain name. There are several common ways to deploy this dynamic content generation:<\/p>\n Code with the URL of a loaded icon corresponding to the victim’s domain<\/em><\/strong><\/p>\n User-Related Dynamic Content: content from phishing website along with text and an icon loaded using the domain name in the URL<\/em><\/strong><\/p>\n<\/li>\n iFrame with legitimate website as the background<\/em><\/strong><\/p>\n<\/li>\n<\/ul>\n Some sophisticated phishing kits include functional elements which prevent a page from being accessed by unwelcome agents, such as bots used by known anti-phishing solution developers or search engines. The latter are unwelcome, because if a phishing page ends up being a search-result hit, there’s a high risk it’ll soon get blocked.<\/p>\n Contents of sophisticated phishing-kit archive with bot detection<\/em><\/strong><\/p>\n Apart from that, some of the phishing kits we detected used geoblocking. For example, phishing attacks written in Japanese had pages which could only be opened from Japanese IP addresses. Blocking tended to be triggered by the detection of the User Agent string, which identifies the user’s browser, or based on their IP address, although there are also some technologies which analyze request headers. This was all done in order to reduce the risk of detection by bots from the developers of anti-phishing solutions scanning the phishing page, and to avoid ending up in anti-phishing databases.<\/p>\n Some phishing kits add various obfuscation options for the generated pages and pure “junk” code which aims to make it harder for anti-phishing solutions to detect and block these pages. Some tricks worth highlighting include:<\/p>\n Code of a page with text encrypted in Caesar code<\/em><\/strong><\/p>\n<\/li>\n Junk HTML tags<\/em><\/strong><\/p>\n<\/li>\n String slicing<\/strong>: concealing malicious links in code<\/em><\/p>\n<\/li>\n It is also worth mentioning that similar forms of obfuscation can also be used by the developers of phishing kits themselves with the aim of getting hold of data their clients have managed to collect using their product. In this case, it is not the text of the phishing page that’s obfuscated, but the code responsible for transferring information back to the creator of the phishing kit is made obscure to prevent the client using the kit from understanding it.<\/p>\n These methods may aim to prevent anti-phishing solutions from finding clues in the original page which would allow them to classify it as a phishing page. However, we have learned how to detect and successfully block these fake pages using deep automated analysis of content.<\/p>\n Phishing kits can be purchased on insider forums on the dark web or through private Telegram channels. Prices vary and more often than not depend on the level of sophistication and quality a particular kit has to offer. For instance, phishing kits up for sale on one Telegram channel are priced from USD 50 to 900. Moreover, some phishing kits are freely available online.<\/p>\nContents of phishing kits: basic and complex phishing kits<\/h2>\n
<\/a><\/p>\n\n
<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n\n
<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\nAnti-detection methods<\/h2>\n
<\/a><\/p>\n\n
<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\nPhishing-kit pricing and marketplace<\/h2>\n