{"id":11659,"date":"2025-02-19T10:55:23","date_gmt":"2025-02-19T10:55:23","guid":{"rendered":"\/cybersecurity-blog\/?p=11659"},"modified":"2025-03-04T06:08:02","modified_gmt":"2025-03-04T06:08:02","slug":"how-to-track-phishkits","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/how-to-track-phishkits\/","title":{"rendered":"How to Identify and Investigate Phishing Kit Attacks"},"content":{"rendered":"\n
Phishing kits have invested greatly in the popularity of phishing. They drop the entry threshold for cybercriminals enabling even low-skilled hackers to conduct successful attacks. <\/p>\n\n\n\n
In general, a phishing kit is a set of tools for creating convincing fake webpages, sites, or emails that trick users into divulging sensitive information like passwords or credit card credentials. Security specialists should never underestimate this type of malware and fail to be ready to counter its users. <\/p>\n\n\n\n
What Phishkits are made of <\/h2>\n\n\n\n
These ready-to-use packages can be basic, with some pre-written code and website and email templates, and they can be advanced phishing-as-a-service (PHaaS) kits that offer more sophisticated and customizable features. These may even contain automated updates or encryption features. <\/p>\n\n\n\n
Data harvesting scripts that capture input in webpage forms <\/li>\n\n\n\n
Automated deployment tools for quick setup <\/li>\n\n\n\n
Bypass techniques such as reverse proxies that intercept multi-factor authentication <\/li>\n\n\n\n
Server-side components that manage the data collected from victims <\/li>\n<\/ul>\n\n\n\n
Some notable Phishkits <\/h2>\n\n\n\n
\n
16Shop<\/strong>: targeted Apple, PayPal, and Amazon users and was distributed as a subscription service. <\/li>\n\n\n\n
Evilginx2<\/strong>: a framework to intercept authentication tokens that helped to bypass MFA. <\/li>\n\n\n\n
BulletProofLink<\/strong>: a PHaaS platform that offered pre-hosted phishing pages and even reused stolen credentials to maximize profit. <\/li>\n<\/ul>\n\n\n
\nExample of a Greatness phishkit attack analyzed in ANY.RUN’s Interactive Sandbox<\/em><\/figcaption><\/figure><\/div>\n\n\n
\n
Greatness<\/strong>: targets Microsoft 365 users and can dynamically generate fake login pages customized for the victim. <\/li>\n\n\n\n
GoPhish<\/strong>: an open-source framework meant for businesses to test their exposure to phishing by imitating attacks but also used maliciously. <\/li>\n\n\n\n
King Phisher<\/strong>: offers advanced features like campaign management and cloning of websites. <\/li>\n\n\n\n
Blitz<\/strong>: known for its simplicity and quick creation of phishing webpages. <\/li>\n<\/ul>\n\n\n\n
Why Phishkits are a serious issue for businesses <\/h2>\n\n\n\n
Phishing kits are employed to attack both individuals and organizations, but they represent a specific threat to businesses by inviting wider audience of would-be hackers to the industry, multiplying risks and providing an increased workload to security systems.
Besides, phishing kit attacks make it easier to turn any employee into a soft spot of the cyber security perimeter. Even targeted at people, such attacks are a headache for SOC teams.
The features of phishkits that pose increased risks for organizations are:
Scalability<\/strong>: They allow attackers to automate and run phishing campaigns against thousands of employees simultaneously. <\/p>\n\n\n\n
MFA Bypass<\/strong>: Modern phishkits integrate Adversary-in-the-Middle (AiTM) techniques to steal session cookies, bypassing multi-factor authentication. <\/p>\n\n\n\n
Brand Abuse & Reputation Damage<\/strong>: Phishing pages tend to impersonate well-known brands, leading to loss of their customer trust when credentials are stolen. <\/p>\n\n\n\n
Supply Chain Attacks<\/strong>: Phishkits can be used to target third-party vendors and gain access to corporate networks via compromised partners. <\/p>\n\n\n\n
Defusing Phishkits with Threat Intelligence <\/h2>\n\n\n\n
![\"\"](\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/greatness_phishkit-1024x578.png\")
![\"\"](\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/ti_lookup-1-1024x600.png\")