Phishing-as-a-service: Tools, tactics, and risks for organizations

SaaS models have spread to the dark web, and that’s a problem. Criminals can now buy or sell the technology needed to mount diverse cyberattacks, including large-scale phishing campaigns.

Phishing-as-a-service (PhaaS) is a critical cyber risk for all companies. Attacks that were once too complex for low-skill hackers now have an affordable price tag. This article will introduce how PhaaS works, what kits offer, and how to respond.

What is phishing-as-a-service (PhaaS) and who uses it?

Phishing-as-a-service allows unskilled cyber attackers to run phishing attacks by purchasing or renting advanced tools. PhaaS kits created by specialist developers enable novice attackers to build fake websites or send believable emails from trusted contacts.

Phishing-as-a-service streamlines phishing activities. Previously, threat actors needed to build websites, implant payloads, and research targets to create social engineering content. PhaaS provides ready-made phishing kits via familiar subscription models.

PhaaS emerged due to the rising demand for phishing technologies from professional criminal collectives and fraud rings. However, malicious insiders may also purchase and use PhaaS kits to damage their employers and steal sensitive data.

Common features offered in phishing kits

Phishing-as-a-service kits include the tools to contact, manipulate, and attack targets. Common elements of phishing kits include:

• Customizable templates. Developers include email templates or web pages from legitimate brands. Phishers can enter basic details for each target, or customize the content if needed. Advanced templates offer responsive designs for mobile devices and desktops, and may also include geolocation tools to tailor phishing emails and pages to different regions.
• Fake login pages. Developers create sites resembling portals for reputable brands (for instance, Google Mail). These phishing domains harvest login credentials from unsuspecting visitors. Advanced kits may include Captcha filters to add credibility.
• Data harvesting tools. Kits provide backend tools to harvest information from phishing pages and securely store exfiltrated data. Developers may offer encrypted storage via Telegram as a core function or an optional add-on.
• SMS spoofing tools. Kits allow users to send large quantities of SMS messages from seemingly trusted sources. This is particularly effective when phishers aim to capture one-time passwords and gain access to internal networks.
• Email spoofing tools. Spoofing allows phishers to bypass email security filters. Phishing tools create fake sender addresses that resemble legitimate contacts.
• Obfuscation tools. Phishing kits include tools to avoid detection by security systems or make analyzing phishing pages more complex. For example, kits may use URL redirection or content cloaking to avoid filters flagging sites as dangerous.
• Domain spoofing. Kits include tools to create fake websites that resemble legitimate versions. They may use homoglyphs or typosquatting to generate domains that contain spelling errors but superficially appear convincing.
• Analytics dashboards. Advanced phishing-as-a-service kits include dashboards to monitor key metrics. For example, analytics tools track click-through rates, rates of successful phishing attempts, and how often victims open malicious attachments. Dashboards may also enable A/B testing to fine-tune phishing techniques and help attackers work around security filters.
• Customer support/documentation. Some phishing-as-a-service vendors offer onboarding and operational assistance. Kits often feature step-by-step tutorials to evade security measures, research potential victims, and harvest stolen data.
• Authentication bypassing. Advanced kits like Tycoon 2FA use fake login portals and reverse proxies to create authentic sessions using intercepted credentials – potentially bypassing multi-factor authentication controls.
• Automatic updates. High-quality phishing kits automatically update tools to work around the latest anti-phishing software.
• Integrations. Phishing-as-a-service is part of a wider cybercrime ecosystem. For instance, phishing kits integrate with keyloggers and infostealers to gather information and enhance social engineering attacks.

Like standard SaaS, phishing-as-a-service kits provide everything users need to begin operations while minimizing the need for IT expertise. Developers sell flexible payment options, streamline tools for novices, ensure regular updates, and support customer queries.