W3LL Phishing Kit Bypasses MFA and Hijacks 8,000+ Microsoft 365 Accounts

Recently, an attacker named W3LL developed a phishing toolkit that bypasses multi-factor authentication along with other tools, compromising over 8,000 Microsoft 365 corporate accounts.

Over the past ten months, security researchers have found W3LL's utilities and infrastructure being used to set up approximately 850 phishing campaigns targeting the credentials of over 56,000 Microsoft 365 accounts.

▍Business Development

W3LL's custom phishing tools serve at least 500 attackers and are used in business email compromise (BEC) attacks, causing millions of dollars in financial losses.

Researchers state that W3LL's inventory covers almost the entire kill chain of a BEC operation and can be operated by "attackers of various technical levels."

The latest report provides detailed information about W3LL and how it has grown to become one of the most advanced malicious developers for BEC syndicates.

The first evidence of W3LL's activity was in 2017 when the developer began offering a custom bulk mailing tool called W3LL SMTP Sender, which was used for sending spam.

W3LL's popularity and business began to grow when the company started selling a custom phishing toolkit targeting Microsoft 365 corporate accounts.

In 2018, W3LL launched the W3LL Store, promoting and selling tools to a closed community of attackers.

W3LL's primary weapon, the W3LL Panel, can be considered one of the most advanced phishing kits of its class, featuring adversary-in-the-middle capabilities, APIs, source code protection, and other unique features.

▍W3LL Arsenal Used for BEC Attacks

In addition to the W3LL Panel, which is designed to bypass multi-factor authentication (MFA), the developer also provides 16 tools, all of which are prepared for BEC attacks. The catalog includes:

• SMTP senders PunnySender and W3LL Sender

• The malicious link stager W3LL Redirect

• A vulnerability scanner called OKELO

• An automated account discovery utility named CONTOOL

• An email validator called LOMPAT

According to the report, the W3LL Store provides end-to-end solutions for deploying BEC attacks, from the initial phase of picking victims and phishing lures with weaponized attachments (default or custom), to launching phishing emails that land in the victim's inbox.

Researchers said W3LL is skilled enough to protect its tools from detection or takedowns by deploying and hosting them on compromised web servers and services.

However, clients can also choose to use W3LL's OKELO scanner to find vulnerable systems and access those systems on their own.

BEC Attack Kill Chain Using W3LL Tools

▍Bypassing Filters and Security Proxies

Some of the techniques W3LL uses to bypass email gateways and security proxies include various obfuscation methods on email headers and text bodies (Punycode, HTML tags, images, links to remote content).

The initial phishing links are also delivered using multiple detection evasion methods. One is via phishing attachments rather than embedding them in the email body.

Researchers found that links were placed in an HTML file as an attachment. When a victim opens the malicious HTML (which may disguise itself as a document or voice message), a browser window opens with a "real-looking MS Outlook animation."

This is the W3LL Panel phishing page, which is used to harvest Microsoft 365 account credentials.

After analyzing a real W3LL phishing attachment, the report stated it is an HTML file displaying the website through base64-encoded obfuscated JavaScript inside an iframe.

W3LL Phishing Attachment Observed in the Wild

In a new version updated in late June, W3LL added multiple layers of obfuscation and encoding. It loads scripts directly from the W3LL Panel instead of including them in the HTML code.

The event chain for the recent version is shown below:

Updated W3LL Phishing Attachment

▍Hijacking Microsoft 365 Corporate Accounts

Researchers explained that the initial link in the phishing lure does not lead to the fake Microsoft 365 login page in the W3LL Panel; it is just the beginning of a redirection chain designed solely to prevent discovery of the W3LL Panel phishing page.

For W3LL to compromise Microsoft 365 accounts, it uses Adversary-in-the-Middle/Man-in-the-Middle (AitM/MitM) techniques, where communication between the victim and the Microsoft server passes through the W3LL Panel and the W3LL Store acting as backend systems.

The goal is to harvest the victim's authentication session cookie. To do this, the W3LL Panel goes through several steps, which include:

• Passing CAPTCHA validation

• Setting up the correct fake login page

• Validating the victim's account

• Fetching the target organization's branding identity

• Obtaining cookies for the login process

• Identifying account types

• Verifying passwords

• Obtaining One-Time Passwords (OTP)

• Obtaining authenticated session cookies

Once the W3LL Panel obtains the authentication session cookie, the account is compromised, and a PDF document is shown to the victim to make the login request look legitimate.

▍Account Discovery Phase

Using CONTOOL, attackers can automatically search for emails, phone numbers, attachments, documents, or URLs used by the victim, which may assist in the lateral movement phase.

The tool can also monitor, filter, and modify incoming emails, as well as receive notifications based on specific keywords in a Telegram account.

Typical outcomes of such attacks are:

• Data theft

• Forging invoices with the attacker's payment information

• Impersonating professional services to send fraudulent payment requests to clients

• Typical BEC fraud—contacting executives and instructing employees to wire funds or purchase goods on their behalf

• Distributing malware

▍Profitability and Pricing

After researching the functionality of the W3LL Panel, the report described from a technical perspective how certain features achieve their intended goals, whether in evading detection or harvesting data.

The W3LL Panel is the developer's crown jewel product, priced at $500 USD for three months, with a monthly renewal price of $150 USD. Licenses to activate it must also be purchased.

Below is the purchase page for the suite and administration panel:

W3LL Store and W3LL Panel Management

This W3LL attacker has been around for about five years, accumulating a client base of over 500 cyberattackers, with more than 12,000 items available in their store.

In addition to phishing and BEC-related tools, W3LL also offers access to compromised web services (web shells, email, content management systems), SSH and RDP servers, hosting and cloud service accounts, business email domains, VPN accounts, and hijacked email accounts.

Between October 2022 and July 2023, W3LL sold over 3,800 items, with an estimated turnover exceeding $500,000 USD.

With cybercrime becoming increasingly industrialized in recent years, the crimeware provided by syndicates like W3LL has gradually transitioned to a SaaS model. This means that for more and more attackers, the entry barrier for cyberattacks is lowering; even novice script kiddies can acquire powerful attack capabilities by purchasing these attack services.

As more attackers enter the field, it also means no enterprise should harbor illusions of safety. Validating the effectiveness of one's own defense system and discovering and remediating defense blind spots has become more urgent than ever.

The SenXun Security Metrics Validation Platform can simulate a series of cyber deception attack behaviors, such as phishing emails containing malicious links or attachments, to provide enterprises with safe and effective defense system validation services. Through visualized reports, it helps enterprises identify shortfalls in their defense systems and make corresponding adjustments and preparations, reducing the costs spent by security teams handling phishing emails.

You can easily select validation experiments for phishing emails containing malicious links or attachments in the SenXun Security Metrics Validation Platform. Simply specify validation bots to send these emails to targeted email addresses within your corporate email system to verify whether your corporate email security products have the capability to detect, quarantine, or delete these phishing emails.