WyzGuys Tech Talk

Phishing Email Alerts

Catch of the Day:  Evil Proxy Phish (Phishing as a Service)
Chef’s Special: Man in the Middle Phish

Examples of clever phish that made it past my spam filters and into my inbox. Some are sent by clients or readers like you, and other reliable sources on the Internet.

You can send phishing samples to me at phish@wyzguys.com.

My intention is to provide a warning and show current examples of phishing scams, related articles, and education about how these scams and exploits work, and how to detect them in your inbox. If the pictures are too small or extend off the page, double clicking the image will display them in a photo viewer app.

[Eye Opener] The New Evil Proxy Phishing-as-a-Service Platform Beats MFA

Researchers at Resecurity have discovered a new Phishing-as-a-Service (PhaaS) platform called “EvilProxy” that’s being offered on the dark web. EvilProxy is designed to target accounts on a variety of platforms, including Apple, Facebook, GoDaddy, GitHub, Google, Dropbox, Instagram, Microsoft, Twitter, Yahoo and Yandex.

Notably, EvilProxy has the ability to steal session cookies, which allows it to access accounts without needing a username, password or multifactor authentication (MFA) tokens.

“EvilProxy actors are using Reverse Proxy and Cookie Injection methods to bypass 2FA authentication – proxyfying victim’s session,” the researchers write. “Previously such methods have been seen in targeted campaigns of APT and cyberespionage groups, however now these methods have been successfully productized in EvilProxy which highlights the significance of growth in attacks against online-services and MFA authorization mechanisms….

“The reverse proxy concept is simple: the bad actors lead victims into a phishing page, use the reverse proxy to fetch all the legitimate content which the user expects including login pages – it sniffs their traffic as it passes through the proxy. This way they can harvest valid session cookies and bypass the need to authenticate with usernames, passwords and/or 2FA tokens.”

EvilProxy is being offered for $400 per month and requires customers to undergo a vetting process to prevent researchers from getting their hands on it. The kit also has extensive anti-analysis features.

Resecurity adds that the platform is also very easy to use, further lowering the bar for inexperienced attackers to carry out sophisticated phishing attacks.

“The portal of EvilProxy contains multiple tutorials and interactive videos regarding the use of the service and configuration tips,” the researchers write. “Being frank – the bad actors did a great job in terms of the service usability, and configurability of new campaigns, traffic flows and data collection.”

Blog post with links:
https://blog.knowbe4.com/new-phishing-as-a-service-platform

Man-in-the-Middle Phishing Attack

[2022.08.25] Here’s a phishing campaign that uses a man-in-the-middle attack to defeat multi-factor authentication:

Microsoft observed a campaign that inserted an attacker-controlled proxy site between the account users and the work server they attempted to log into. When the user entered a password into the proxy site, the proxy site sent it to the real server and then relayed the real server’s response back to the user. Once the authentication was completed, the threat actor stole the session cookie the legitimate site sent, so the user doesn’t need to be reauthenticated at every new page visited. The campaign began with a phishing email with an HTML attachment leading to the proxy server.

Clever Phishing Scam Uses Legitimate PayPal Messages

[2022.09.01] Brian Krebs is reporting on a clever PayPal phishing scam that uses legitimate PayPal messaging.

Basically, the scammers use the PayPal invoicing system to send the email. The email lists a phone number to dispute the charge, which is not PayPal and quickly turns into a request to download and install a remote-access tool.