Surge in Low-Cost Phishing Attacks: Beware of Phishing-as-a-Service (PaaS)

Recently, SonicWall's threat detection expert Immanuel Chavoya discussed Phishing-as-a-Service (PaaS), including the risks it can pose to organisations and how to address this threat.

▌01

PaaS has become a growing threat to organisations. How exactly did this trend come about?

Phishing attacks have increased with the rise of SaaS, and even the most security-savvy employees can be tricked into phishing attacks.

Phishing-as-a-Service (PaaS) is a new phenomenon. This trend involves cybercriminals acting as service providers, conducting attacks for others rather than themselves to gain profit. The emergence of PaaS means that hackers have become more organised, commercialised, and are seeking greater gains from ransomware.

Attackers do not need the technical knowledge to build or take over infrastructure to host phishing kits (which simulate various login pages); instead, the introduction of PaaS significantly lowers the barrier to entry.

Last year, BulletProofLink, a massive SaaS campaign launched by criminals, was exposed by Microsoft, revealing over 300,000 newly created unique subdomains. The turnkey platform allows users to customise campaigns and create their own phishing strategies, providing them with over 100 phishing templates that replicate known brands and service guides, kits, hosting, and other tools.

▌02

How does PaaS simplify the work of cybercriminals?

It results in any attacker limited by technical skills being able to start a phishing campaign against a target organisation for less than $15 a day.

So in the past, the barrier to entry was slightly higher, but not by much. Back then, attackers had to perform many steps, such as purchasing phishing kits, setting up infrastructure, obtaining email lists, sending spam with credential harvester (or malware dropper) links to the email lists, and collecting credentials. This could also be used for subsequent attacks (or sold as an IAB). PaaS allows actors to complete most of the work for a small transaction fee of $400 per month.

▌03

What should organisations worry about most when it comes to PaaS?

The massive distribution of the workforce post-pandemic has expanded the security perimeter of enterprises. This has created favourable conditions for cybercriminals to carry out a range of attacks, the most common of which is phishing.

A recent survey on enterprises' biggest cyber concerns ranked phishing attacks at the top, discovering several phishing campaigns designed to trick busy or distracted employees. Organisations that enable and then disable multi-factor authentication (MFA) may face risks in new PaaS campaigns, as attackers have begun to formalise their methods.

However, lower-skilled attackers can purchase phishing services, such as EvilProxy, and use reverse proxies to bypass MFA controls, harvesting valid cookies from users connecting through the malicious proxy phishing site. In this way, attackers can bypass the need for authentication using a username/password or MFA token.

▌04

How can organisations respond to this threat?

PaaS can be highly advanced, with capabilities ranging from detecting sandbox environments to fingerprinting user agents to determine if you might be a researcher's bot. That being said, web content filters can usually limit user exposure. For example, if your email security solution does not detect a PaaS threat and your user clicks a link, if you have a defense-in-depth approach, you might have a web content filter capable of monitoring application and DNS traffic. This limits access to "newly registered" domains or domains with poor reputation, contributing to a layered defense against PaaS.

▌05

How does it affect businesses, and what can they do to protect themselves?

As cloud platforms replace programs installed on devices, two-factor authentication has become a common practice for enterprise identity access management. This is where phishing can flourish. Phishing scams rely on the muscle memory formed during daily repetitive login processes to steal credentials.

Many of the HTML phishing scams observed last year revolved around launching a login form pre-filled with the employee's email address. All anyone is bound to do is enter their password without hesitation, letting the cybercriminals in. The attacker then sends the password to a remote server hosted by malware, and the user is redirected to a legitimate website.

The Pyxsoft Security Metrics Validation Platform is capable of simulating a series of cyber fraud attacks, such as phishing emails containing malicious links or malicious attachments, providing enterprises with safe and effective defense system validation services.

You can easily select validation experiments for phishing emails containing malicious links or malicious attachments in the Pyxsoft Security Metrics Validation Platform, and designate AI offensive and defensive bots to send these emails to specified email addresses within the enterprise email system, to verify whether your enterprise's email security products have the capability to detect these phishing emails and quarantine or delete them.

| Reference Source:

https://www.helpnetsecurity.com/2022/10/11/paas-risks/