Name: Phishing with Dynamite 🧨
Uploaded: 2026-07-09T18:16:36.295Z
Duration: 1 h 1 min 32 s
Description: Phishing with Dynamite 🧨

Transcript for "Phishing with Dynamite 🧨": Hello. Hello. What is up, my friends? I'm gonna make the chat wider on my screen so I can see more than one message at a time. How's everyone doing? Well, I hope. Chien, hi. Hello. Hello. Oh, there's okay. Now I see the chat. What's up? Dion, Leon, Joe. What is up? What is up? Thank you guys for joining. The locations are sick. Ohio. That is a wonderful place. Evan, how are you? Ben, what's up? Carla, Italy. Oh, awesome. No. Virginia is for lovers, Joe, but close. Sri Lanka. Welcome, Mohammed. Very cool. India. Giki. Awesome. Well, we have another this is a co branded and co presented webinar, Andre. Andre is currently having technical problems, so I will kick us off. If if if Andre can't join, for technical issues, no big deal. I will take us through a ridiculous amount of cool, stuff, but, hopefully, he hops in here and and joins us. But it's gonna be a really exciting, presentation. There's a lot of novel stuff we're seeing in the world of fishing that's been super interesting, to us at Flare and equally interesting to the folks at VMRay who analyze the phishing pages. At Flare, we, you know, pull the contents, from them. We wanna we wanna make sure that, victims who are customers are protected, and we study how they operate for this. And wants to make sure that they're detecting phishing kits, phishing pages as they show up in their, in their tools as users submit them and they, analyze them in the platform. What's what's interesting is the, the flare angle here is the whole universe behind, phishing kits. The the ecosystem and economy has become, pretty vibrant, kind of in a way that we saw with Steeler logs several years ago, which is still a vibrant underground. We're seeing a a similar genesis now with fishing kits, which is really fascinating. Philip from Michigan. What up? Welcome. Andre, I see is, joining. He Andre, you just have to come on stage, and then you'll pop up in here. And as long as we can get him in here, we will do quick, intros, and then we'll kick off. Andre? Hello? Hello? Hello, Nick. I hope you can hear me first of all. I can. Yes. I can. Welcome. Thank Okay. Then let's do quick intros of who we are, and then we'll jump into all the. cool content. I'm Nick Ascoli. I'm our VP of solutions engineering at Flare. So I help make sure Flare, is finding, cool things for our customers and, helping them stay ahead of identity compromises that show up in the wild. I'm also part of our research team, so I keep up with what bad guys are doing, and I try and make sure that the data sources we collect from reflect the, you know, boots on the ground reality of of, what we see, the way we see cyber criminals, sharing, using, buying, selling, or or, how they're interacting with data to, to compromise victims. And, Andre, if you wouldn't mind, quick intro and, hello? Absolutely, Nick. Thank you very much. First of all, thanks for having me me here. My name is Andre, and, I am one of the, product managers at Veeam Ray. We are a sandboxing company, but we will speak about that a lot. During this session, I'm, like, twenty five years in cybersecurity, mostly malware and, efficient things. And, yeah, I'm pretty excited to be here and, run this webinar with you today. Awesome. It's gonna be all it's gonna be very cool. And, yes, Vijaya Kumar, there is indeed dynamite, on the way. At least I hope. I mean, unless you live and breathe fishing kits, a lot of this stuff will be pretty cool. And Joseph from the Czech Republic, very cool. Welcome. Alright. Let's, let's jump into this. So a fishing kit. I'm sure you've seen fishing pages before. You've maybe even opened several of them and entered credentials on them. But the fishing kit is now kind of the operational infrastructure behind a lot of fishing that you see in the wild, today. And the idea behind fishing kits is they do a lot of the work for you. So what we're gonna talk about in this webinar is the economy behind fishing kits, how they work, how the operators leverage them, and all that kind of stuff. We'll talk about active compromises, how you know, what it what it means when someone's entered a credential on on a AI, you know, adversary in the middle proxy phishing page. And then, there's a bunch of really interesting stuff that Andre has, from the VM right angle on what they're seeing in the world of phishing, and how, you know, how they're finding it. There's there's novel techniques and evasions that bad guys are doing, and, it get pasts it gets past some defenses and not others. So in simple terms, a phishing kit is, is basically b to b SaaS software. The b to b is just bad guys, though. It's cyber criminal enterprise to cyber criminal enterprise software. It has customer support. The developers and maintainers and operators of these pages are very active with each other, going back and forth and making sure everything's operating as expected. They do bug fixes very quickly. They're using a lot of, vibe coding tools as you would expect. And it's it's a business. It's it's a business in the same way we saw ransomware and extortion formalized into these, like, operator infrastructures where very low technical actors can now come in and and leverage infrastructure that the technical actors have built to do cybercrime at scale. The same thing, exists in the in the world of phishing. You really don't have to show up with any technical, knowledge at all to be a phishing kit operator. You just have to show up with a little bit of money, buy access to a phishing kit, and it comes with everything. It comes with the lures that you send out. It comes with domain infrastructure attached to the lures to send out. All you have to show up with is email addresses to send emails to. Once you get a few out there and you get a few victims, the phishing kits will have features that go through all of the inboxes of all of your victims and look for other emails to send lures to. And look, you know, it's, it it all you know, once you get a few hooks in as a fisher, you're you're you're pretty much off to the races. Now the economy, behind it is a pretty well packaged and relatively affordable, in the world of cybercrime. A lot of kits have a starting price around a couple $100, and they will usually offer a larger upfront, with a little bit of a discount, a larger upfront for one year of use of the kit. This is roughly where a Cali three sixty five, a very popular fishing kit that we'll talk about, landed about $250 a month, and about $2,000 a year. Usually, they follow this kind of license model of, of monthly or annual income. They also occasionally have add ons and upsells inside the product. Like, you can buy domains from their marketplaces. You can buy additional features. But, usually, it's kind of a one size fits all, pricing model. And you can get discounts or or bonuses or extensions to your access, for affiliate recruiting. So if you recruit if you're a phishing operator and you recruit other operators and they use your affiliate code when signing up, you'll get, credit for this, as a phisher. And then also, most of them now have parity features for, AI powered, like, some of it's regex based, some of it's AI based, notifications. So instead of them having to go track all of their victims' inboxes to find opportunities to do cybercrime or fraud, these AI AI layers that sit on top of the phishing kit will do it for them. It'll find interesting emails or threads or opportunities inside of their victims, usually just email inbox, and it'll it'll outline those opportunities, to the actor so so that they don't have to really study it themselves. So not only do you not have to show up with any technical skill, you don't even have to show up knowing how to be a bad guy. The AI will will do it for you. You don't have to you don't even have to be that creative, as they used to. Now the, there's a few layers to the economy. Every little subeconomy of cybercrime is is a little different. Phishing kits have a kit developer. They have distribution channels, sometimes distributors who get paid. These are like channel partners in, in the regular business world, who will distribute the software for you, occasionally white labeling it, which is fascinating. But usually, the kit developer sells directly to operators. But occasionally, there is a sort of middleman distribution. Now either the distributor or the kid developer will advertise often on Telegram, and occasionally on cybercrime forums. And they'll list the subscription tiers and all of their features and, usually, they they go on aggressive advertising campaigns after a big release and show how they're different from, you know, how Cali three sixty five is better than evil token or tycoon two FA, because it just released these features. And what's interesting is we see a lot of, phishing kit operators not necessarily choose one, but they'll buy multiple phishing kits and run separate campaigns, from each of them. And then the the monetization aspect of phishing kits has been really interesting. It's a, it's a mostly fraud ecosystem. So there while we do see phishing kit operators trying to harvest credentials to resell, which many phishing pages are just for credential harvesting, and they don't do anything interesting. Usually, kits are involved in a more sophisticated fraud operation, slightly more sophisticated. And what they're after is taking over corporate accounts. And, again, this is people who bought a kit, not just people fishing in the wild. There's many reasons to fish. Usually, if you're buying a kit, you have a a a large scalable operation, and you're mostly interested, in our experience looking at these kits, in financial fraud by intercepting financial emails from the inbox. So the inbox of a user you phished, in Office three sixty five may contain the word payment or invoice or accounts payable or, something like this, one of the keywords that indicates that finance is being discussed. These are the types of things that, the keyword alerting features of fishing kits will send to their operators and say, hey. One of your victims is discussing an invoice. Now may now is your time since you own the account. Maybe replace in the next email, send it as the user, and replace the account information with your own. Or send a correction and say, hey. We switched banks. Can you change the invoice to send it, this account? And, you know, you can swoop in and and steal money that is flying across the wire, at your target organization. Now kit developers will often use legitimate open source tools and repurpose them in their kits, and then they'll kind of, like, vibe code a kit, on top of a legitimate tool. And then these are what some of the advertisements look like. You'll notice the word that they use in the in the, world of cybercrime is usually sender. And and often they start out as b to b, they call them b b to b sender. They'll they'll start out as email sending tools that advertise themselves as bypassing, you know, spam, engines and have a really great delivery rate. And then around you know, with successful the success of their sender programs, they will build larger phishing kits, full fledged phishing operations on top of them. I think sometimes they, they use the word sender in their early days. These this Cali three sixty five sender advertisement and evil token b two b sender advertisement were from the very early days of these kits showing up online. I think they're using this terminology to kind of dodge the, actual intent of the, kit as they advertise. But once you get in the these the channels where they really discuss the back end, it's all about crime. These are all, these are not legitimate email sending tools to be used by marketing teams. These are, these are tools expressly designed, for cyber criminals with the intent of doing cybercrime. Now there's two types of lures that are very common, with phishing kits. The first one is a reverse proxy adversary in the middle. This is literally just the phishing the phishing page is just a proxy for a real login page, and the other one is device code phishing. These two are are very popular in the kits that we see right now. So adversary in the middle, you know, without a device code is literally just, it's like you're looking in order to see the website, you've you've placed, like, a piece of glass in front of the user's monitor, and you're just seeing everything they do on this website. So you are hosting you you are literally just acting as a a a web proxy for someone's connection to the website through your phishing link. So you'll send a phishing page, and to the user, it will load the real Microsoft online login, and they're really interacting with the real Microsoft online login, but through your proxy. So everything they enter, every cookie that is sent from received or sent from the user or from the, service they're logging into is intercepted, by you, the phisher, by the bad guy. So once and usually, they're not after with the adversary in the middle proxy. They're not really interested in, in your in your creds. They're interested in the session that is issued from entering legitimate credentials and then maybe entering an MFA token. So with these kits, they're usually after your, ESTS, auth persistent or ESTS auth tokens that Microsoft, issues. So, again, you're going to see as a user the actual Microsoft login page, but, you know, from a fake domain. The and the the fake domain the bad guy set up is the proxy, itself. So the bad guy sits in the middle watching, the credentials get entered. And this is usually what it's going to look like. It's just gonna be the actual now this may be a fake one, but the phishing page is going to resemble the actual page you're attempting to log into. And, this is from a real login page or from a real phishing page that I opened in, in VM Ray and put credentials in, to test. And, it it is indeed proxying these credentials, and then afterwards, it it just pipes you to Google for some reason. It's like an out fake Outlook Gmail interactor. But the the adversary proxy literally just shows you the web page you're logging into. Now the other one, that's becoming increasingly popular is device code phishing. Now the device code is where before sending the lure or as the lure is loading, a bad guy will request a device code for your account from Microsoft. And the a device is like when you register, like, in a a funny example is, maybe not the best example, but, like, in your corporate cafeteria, there's probably a TV displaying a menu with, today's prices for the cafeteria items, that you can buy. This is most likely a domain joined, TV that's been registered as a registered device, as an authorized device to someone's account. And in order to set this up, they had to enter a device code to register the device. This is also common for, like this is a common flow for when you, on Roku, log in to Netflix. You can either enter your password directly there with, like, click click click click, letter. Click click click click letter very slowly, or in you have the option to log in on your phone, enter the code, the device code that's written on your screen, you know, a few characters, and then it'll it tells Netflix, hey. You know, this person is who they say they are. You can you can log them into Netflix on the TV now. The idea is you're registering, a device to access your account. So they will request a code from Microsoft for your account. You don't need to authenticate to do this. All they need is your email to do this. They Microsoft will then say, hey. You know, you're trying to register this, a device to this account. Log in to your account and enter this code, and it'll generate a code and send it back to the bad guy. And then the bad guy will create a phishing page, put that code on the phishing page, and say, hey. Here's a DocuSign you have to sign. In order to sign it, please log in. And the login will say, please enter this code to log in. And it's it's actually you know, they're they're not telling you that it's a a device code. This would be way too confusing. You're just assuming, some weird way Microsoft wants me to log in as the user. You fill out, the device code that's written on the screen. You know, the real Microsoft online login pops up. If you ran this through any analysis, this is real. Like, it's it shows you the real Microsoft login they open, and then they say, hey. Copy the device code from here. Enter it on Microsoft, and then, you can proceed. And once you've entered that code, the bad guy now has an access token, and a registered device to get into your account. A question in the chat. Jordan asked, what percentage of Fishers doing this do you think are just script kitties with a kit? It honestly, it's so hard to say. I've seen many phishing kit operators who are obviously sophisticated financial fraud, you know, financial fraudsters and operations. And you see and they have varying levels of success. Usually, the the more impressive financial fraudsters, have reasonably successful campaigns. And usually the, the the the script kitty types, the, you know, newbie who bought a fishing kit, doesn't really have, much. But the kits do a lot more for you than than they did in the past. So, someone a sophisticated fraudster and, someone who's just getting into crime, are gonna have a very similar user experience and potentially similar success rates now with the kit because, again, it does, like, all of the work for you. So it's doing the same work no matter what level of sophistication you are. But percentage, it's so hard to say. And for so for Demise code phishing, this is what it actually looks like. And I'm gonna skip ahead to a video, that a, a threat actor posted recently to advertise new lures that, that they were selling. On mute, there's, like, a really obnoxious, rap beat that plays in the background, that's way too loud no matter what the volume is. Okay. So this one is you open up, you know, the email is gonna contain this link and say, you know, to access this file in OneDrive, please click here. It'll verify that you're a human. You'll go to the next phase here, loading OneDrive. And then this is a this is a totally fake, again, probably Vibe coded page that has a, a OneDrive looking group group of folders in here. And it's gonna say, in order to access these folders, please enter you know, please log in. And the login is gonna open up. Again, it just because you visited this page, the bad guy generated you a device code legitimately for your account and is now saying, hey, please, enter please log in using this device code to access OneDrive. You know, we're asking you to reauthenticate. And then when you click it, it opens a real Microsoft online device code access. So it's saying, enter this code, and it's the code right here that Microsoft generated and the bad guy put on their phishing page in order to visit this page. And then this is the next one they show off. So they do their little fake verification step. This one's for Microsoft Teams, and this one's really interesting. So, they say continue on browser or open the Teams app. If you continue on the browser, I suspect the open in Teams app thing doesn't work. It opens a device code, page, this time Teams branded. And when you click to log in, it makes you think that you're actually proceeding into a a a Teams meeting. Like, on the page in the background, join people start joining the meeting. So I'm sure the prompt here in the email they send you is, like, you have to join this urgent meeting. It's an emergency. Please please hop in right now. And you see, like, the the sense of urgency here, I'm sure, is very real on the victim's end. You see joint what looks like actual people in a Teams meeting, that you're supposed to enter, and then, you know, it says, you know, hey. You gotta get in this meeting. Enter your please log in to do it. And then it says, enter this code on this thing. And it all it all feels very, very real, especially because the device code page is the legit Microsoft login. Samhita asks, is Telegram the primary marketplace for these kids? Yeah. Without a doubt, Telegram is the primary marketplace for these kids. Now as the phishing kit operator, you have a very simple interface to create lures to view your victims who are still active, who have their tokens still active. A lot of these are targeting Office three sixty five. So, or, you know, Microsoft in general. They want your they want access to your, your intra provisioned account and your identity that's federated to all of the tools that they might want to access as you. So all of this is displayed very simply, for the, for the phishing operator. It's tracking the number of tokens they've harvested from users, which users those tokens tie back to, how many lures you've created and sent out, a new sender for sending out new emails, keywords you wanna be notified of if they show up in someone's inbox, an AI assistant to help you plan attacks or study a victim that you have. And this is what it actually looks like in a real phishing panel. So this is a screenshot from a real one. I did a little reproduction so that it's easier to read, but this is what it looks like for the user. And it's, you know, it's exactly what I discussed. There's a very simple LURS page, a very simple vault of all the tokens you've stolen. And then, there's an email extractor. And what this does is when you do have a victim, it will access because through the through the device code or through their regular access token, they'll have, read right in the in the victim's mailbox. And they will read everything in the victim's mailbox and find new potential victims to send lures to so that you cannot just view the, you know, e so that you can move laterally, with your accounts. And then it will also look inside of emails for people, you know, external parties, other interesting people, anyone who's ever been cc'd or in the to from field or bcc field of anything that has been sent by this user, and then in the in the cc to or from, of anything that they've sent will be extracted. So it's not just you're not just seeing net new content. You get to go through the history of the inbox, and the the phishing kit will do this for you. The other thing is the lure builder is is at this point, they're trivially easy to use in all of the all of the phishing kits that are public. So you select the language you want your kit in. You select whether you want the full screen to show, just the login page, whether you want it to be split screen, so, like, an auth on the right side and, you know, DocuSign on the left or a modal. So there's background content with an auth pop up, like what we saw with the, fake Teams background and the, OneDrive background. Like, those were branded pages and had content in the background that made it look even more potentially even more legitimate, to, to someone logging in, or more suspicious depending on your your sort of level of knowledge here. And then you pick the brand you'd like to, mimic. So, usually, if you've studied up at all on on your, victim as the fisher, it's easy to select. Otherwise, you just stick with the, common ones. You know, if you know they're a Microsoft shop, then then you're just gonna go OneDrive or Teams or SharePoint, and it'll be relatively, easy to make a very convincing page. Now the the links from those pages are gonna be sketchy. They're often coming from CloudFlare workers, hosted on workers.dev, and they're like a subdomain of it. Or you can bring your own domains or sometimes buy domains from the domain marketplaces that these phishing kits have. And then in the in the, this is what it looks like for real. So, again, just in case this was hard to see, I made that reproduction, but this is what it looks like to actually make, the lure. It's exactly what I, showed there. You get to select the domain it's coming from. Right? It could be, several. And then if you want to browse interactively, the user's inbox, you usually just, download the the client. Cali 365, for example, has a real version of this. You download the live browser client, and then you're able to, interactively browse, inside of the, the victim's, Outlook in Outlook. So it actually will open up Outlook, and you get to browse as if you were the user, and it's, you know, obnoxiously simple to do. It makes it very easy for you. And we also noticed over time that Cali three sixty five UI, changed, a lot. It it got a it got a few, big face lifts. It it became much simpler, much easier to, browse through. The font choice was, nicer. The whole user experience, was was vastly improved over time. And how this was done, was Cursor. So there is not just suspicion that these kits are, vibe coded, but it's it's generally well understood that, AI tools are a big part of how, how these kits, why there's so many of them right now, why they're so easy to use and so successful, and why the underground of them has so many more, so much easier to observe activity. In this case, we know cursor was in use because in one of these screenshots we saw, a cursor tab was open, and this was an advertisement from the kit. There were, in fact, several cursor tabs open, and it was an ad again, an advertisement from, you know, most likely, an affiliate or, the the developer of the kit themselves. So we know that they were, vibe coding on top of the platform, with cursors specifically. Now in Flare, we see a lot of interesting activity around this from our, our our many data sources. And two of the interesting ones we saw that tied back to Cali three sixty five specifically were, these new capture events, which meant someone new visited your efficient page and successfully had their cookies harvested from the off flow. And then the other one was keyword alerts. And these were, keyword notifications, that an email had shown up in their inbox that matched one of the terms you're interested in knowing about. Invoice payment, there were hundreds of, of terms here. And over the course of the this campaign, which is or or this phishing kits activity, which is still active, they said they shut down. The FBI put out a PSA, and then, Cali three sixty five said they shut down. But, absolutely, we we still see activity consistent with the kit. Over the course of our observation of the kit, we saw 900,000 financial keyword alerts, and these are still coming in. So I I we see more of these. We saw fourteen thousand compromised victims, from 10,000 unique victim organizations, several organizations with many victims. So there's a lot of, lateral movement here. And this is not all of the activity. This is just the activity that we were able to, observe and and study. But there's most likely, you know, this may be a a healthy amount of it, but there's most likely more than this, out there, and we're continuing to do, an effort to collect this. And and also a reminder, this is just one kit. Tycoon is still popular, even with law enforcement, engagement, which is, you know, great to see. The kits still, these still they still pop back up interactive. EVIL token is still in use. Cali three sixty five is still in use. And there there are many other phishing kits, that are competing for popularity. This is just one, and the activity we've been able to observe from one is over 900,000 keyword alerts. That's not every email in every victim's inbox. That's only those that contained a financial related keyword that give them an opportunity potent to potentially do, fraud. So it's it's just nuts, that they've become, so successful. And this rise in popularity for, token theft and phishing kits is is primarily due to, MFA being a big blocker. At least in in the conversations that we see in the study and we do cyber criminals, this seems to be a big reason, is MFA gets in the way, a lot. But if you can harvest the actual refresh token or access token or, you know, whatever the appropriate cookie is that is used to authenticate to something, it's much easier to just take over an active session, than it is to, you know, steal an MFA token. Of course, unless you proxy it, unless you're proxying it, it's hard to, you know, it's kind of hard to do that. Sim you you're not gonna SIM swap someone to phish them unless you're, you know, there's there's only a few types of, cybercriminals who do that. But, this is just easy to do. It's easy to create. It's easy to make the proxy. And once you've got a victim on the proxy page, it looks more legitimate than any lure that, you know, you could have created because it's the real page. And then the device code thing is also trivially easy, and registering a device is is a a feature built into Microsoft. So, of course, a lot of people have turned this off. I I suggest you turn it off. But with the amount of victims we've seen, it's still very, very commonly, enabled and easy for bad guys to do. And then also, part of the rise in popularity of of session theft is just that it's the method that kids use. And at the same time, kits are becoming popular, or more popular because, they're they're there's they do all the work for you. There's if you if you, you know, purchase a fishing kit as a cybercriminal, there's not a whole lot you need to bring to the kit, to get to work. It's it's doing a lot of that lifting on your behalf. Now there's other activity we've we've observed in the wild. This is what it looks like in Flare, by the way. So I took a real phishing, domain, plugged it into VM. Right? Which analyzed it, determined it was phishing, has a really cool analysis on the the page I plugged in. And I plugged in, fake credentials and authenticated, with them to that Outlook page I showed you earlier. Now in Flare, we intercepted, through one of our collectors that, username and password, you know, my fake username here, my two fake passwords here, and then information about my, connection to that phishing page. This is the, URL, by the way, that I, used to enter. And what we do at Flare, quick plug of what our actual part of our business is, is when we intercept these logins, when we capture them from, from the wild and they affect, they affect you, and if you've connected us to Entra or Okta, otherwise, we can just notify you. But if you've connected us to Entra or Okta in your environment, we can take that username and password and immediately revoke sessions on the account, block it, lock it down. The idea being you have to act very quickly on these because, this isn't a a stolen password that a bad guy might use later. This is usually a a proxy login that has successfully passed muster, and the bad guy's in there right now. So you wanna confirm that these creds are valid, and probably block the account, as quickly as you can. There's a lot of questions in the chat. Let me just do the most recent. Jordan said, probably a stupid question, but are most phishes just about money and not gaining access to the orgs network? Both. There are absolutely phishing, operators who are interested in gaining access to the, to a corporate network and are not so interested in low level financial fraud. But the, like, the feature sets of the kit seem to suggest that it is very popular, for people doing this to be, doing fraud and wanting keyword notifications that are financially that are specifically related to finance. And some of the other in the wild activity we see so this is a a, phishing someone entering their credentials on the phishing page. This was the, person's access token from Microsoft being relayed to the phisher. The phishing page then using that to, bypass multifactor and then letting the phisher know two FA has been completed successfully. Not bypassed, but successfully completed for this user on our phishing page. Another one is as device codes are being entered, on on these phishing pages, sometimes they're being relayed, and we we can pick these up and and see the device code contents in plain text, that have been generated. Another interesting one is, some some pages will modify their behavior based on what the user has done. So in this one, someone entered these credentials on a phishing page, and, the the phishing page said, hey. They entered a valid password. We checked it over, Microsoft, but we got an MFA prompt. So then the the the phishing page will will insert an MFA prompt into the, into the flow and then ask the user to complete MFA. Of course, they proxy it as we showed before, and then they say, hey. No worries. Valid password, but we we we harvested the MFA and successfully completed it. Now if MFA was not enabled, this would've just stopped right here and said, valid password. You know, check. We're in. But because it it found out that MFA was enabled, it did the MFA flow, and proxied it. And this is an interesting we saw thing we saw in in a a cybercrime channel, on Telegram, which was a threat actor sharing with another threat actor who who was using a phishing kit. This email where they were mocking the victim, and they took this screenshot of the user's account that they were in and said, new message in Microsoft Teams. Questionable. Good morning blank. I received this email, but it seemed fishy to me. Not sure if I should open the link and proceed. And they were mocking the victim in that, like, you know, too late. I'm taking a screenshot of this email having already owned your account. So it's these aren't sometimes these are passive compromises. And if you don't have interesting keywords, they're not looking. Sometimes they're very actively, sitting on top of accounts and studying them and potentially doing, you know, as you as, Jordan had asked, potentially doing something more interesting with their access than, financial fraud. And some recent innovations we've seen, is them using AI on the, inbox studying and of the notifications of new emails in the inbox to identify who may be good targets, for fraud. So they'll say, something interesting happened in in this thread. You know, the we saw that that this person is a director of HR. You might wanna, impersonate them with a look alike domain or by trying to take over their account. Another one is we saw this interesting thread with, like, a purchase order in it. We think that because of the account that you, have taken over, you can reply directly to this thread with, you know, fake bank details, modify the invoice with your account details. It it says with attackers bank details, and, basically hijack the purchase order and have them send you the money instead. And then even more detailed ones will show up here that say, you know, here's the amount of money we think you can make from this hijack. This one's really small. Sometimes they're much larger. And it it it gives even more specific instructions to the, threat actor of, like, you know, you can reply to the thread. This is one option. Ask for a candidate, this was like a job interview thread, to submit their Social Security number and date of birth. The next one is a domain spoof. You know, maybe you could make a look alike domain and pretend to be, someone else and, who was involved in this candidate's onboarding and collect information from them that way. And then, also impersonate, in a new email to candidates, requesting personal data for, like, this job or a different job. So, that's all the activity, that we've we've seen so far that we're we're able to share, which is has been some, hopefully, interesting stuff. And I'll, of course, go through the chat and try and answer questions in there directly. But now I'd love to pass it over to Andre. And, Andre, do you want me to keep sharing my screen, or do you wanna take over, screen share? What would be easier for you? You're on mute, by the way. Yeah. Thank you, Nick. Christopher, it was an amazing presentation. Then if you can do this for me, that would be amazing. Yes. Of course. I can. Alternatively, I can take over. No. No worries. I got it. Thank you so much. Yeah. Hi again. I will take over from here, and we will speak a little bit about, first of all, I need to, to introduce the company, obviously, since you all know Flare, but maybe not of not not all of you are aware of VMRay. And, we are a sandboxing company. We started, like, certain years ago next week. We have a company birthday, but, our founders, spent more than two decades in, advanced malware and more recently, phishing analysis. We obviously have a great technology, as Nick already mentioned, that allows us to beat a lot of, complicated things on both malware and phishing side. We do have some great tech. We do have some great data. We sit on great data, that we use to, help our customers. But, I would say that all in all, it all boils down, for us to be very consistent in what we do. We try to help our customers automate advanced malware and advanced phishing analysis. We do this for the last certain years, and that's why we are so successful. If you come for the next slide because I want to take a step back, actually, and we we we had this amazing examples from Nick on how FuseKit operates and what happened after you click on the link. But, one of the questions is actually how how it even happens that this link is in the victim's mailbox? How does it bypass email security? What happens there? And, to, to, tackle that and to to say some words on that, I need to say that we see that in the last four to five years, the phishing journey has significantly changed, like, three, four, five years ago. You just received an email, hey. This is something that you need to immediately respond to. Here is the link. You just click in there. Of course, we are speaking about the initial access. If if, if an attacker has an access to the victim's mailbox of those, it's much simpler and much faster. But if that's an initial takeover, you need to be creative. You need to, find a way to make a user get the URL and then click on something. And, what we found out that it's very rarely, it's just an email with the link in it. If you click on the next slides, Nick, thank you so much. Yeah. What we see, recently is that, EfficientKey is really becoming more of a user journey that is very much designed to fully await automated analysis. Because, obviously, because, obviously, all the attackers know that there are security teams and, there are security vendors that want you to stay protected, that want to block whatever they they, can block and so on and so forth. But, they they they they, want to also, like, elaborate on that and, make the, phishing page that happens at the end of the day that can be fish kit, that can be something else, that can be click fix. I don't know for the initial access. Be available, like, only to those who look like natural user, who accesses from the node that looks like a natural endpoint, natural browser with plugins installed there, and so on and so forth. And they put a lot of effort to, make this journey hard for any automated analysis. And, yes, I have to say it in advance, it's a World Cup, time, and, many of my slides includes different soccer or football pictures depending on what region you are joining from. So, the first thing that I wanted to mention is, that, we see it in the last four years, actually, since Microsoft blocked macros in, Microsoft Office documents and this mark of the web appearance and so on, we see that the payload is no longer delivered through the attachments. And now attachment is not a point where you look for some some malicious, but that's the point where you look for some, next stage of the attack. Now most of the times, you will receive a PDF with the QR code in there. Yeah. We can move on with the QR code in there, and, there will be I don't know. Maybe maybe some URL, maybe something else. I guess it's a great time to move to the next slide. Thank you, Nick. And, to, to give an example, a QR codes are with us. I mean, on the malicious side of the things, not not just QR codes who are, who are, quite an oldie. We started seeing the major, phase of the QR code relation phishing late twenty twenty three maybe, but, they are not going anywhere. I mean, the whole idea of tackling the QR code is pretty simple. You just need to, get what is the URL behind the QR code, then detonate it, I don't know, runs, then run against reputation, do some other activities. What we started seeing at last here is evasive QR codes. There is an example here on the screen that was enough to bypass many email security tool until late twenty twenty five where you just split a QR code in several pieces, then reunite them somewhere, save as a PDF so that they look as a QR code again. But technically, they are several, several pictures reunited. So when a tool looks into that, into that PDF, it sees several pictures. None of them looks like QR code. Nothing to detonate. It's super effective. It's, super easy to achieve. Again, it's one on one, but, we saw a lot of techniques like that, and we keep seeing them just a little bit different flavors with nested QR codes, ASCII based, QR codes, low contrast, and so on. Still more than 20% of the initial attack vector is a QR code which is placed somewhere. Then another example is a redirect. We are aware that when you see a URL, like, the first intention is to check the reputation of the URL. But then it's quite easy to kill with several things. First of all, it's redirect. I use the broad term of, redirect, but, there are ways to also to to to hide the real URL behind something. I will have if I'll have time, I will have one or two examples to show you, but, basically, it's not just a trusted threat director like Google or YouTube on this example or Microsoft or someone else. There can be cases, and we see a lot of that. There was example from Nick, with a probably fake OneDrive, but we also see attackers posting someone on the real OneDrive. You just have a page there. You just have a file there. You open that file. That's an SVG or something else, which redirects you somewhere else, and, suddenly, you're no longer dealing with the trusted URL that leads you to OneDrive, but some blah blah blah blah blah, domain. Another good example is a URL shortener or a QR code shortener or, some other trusted platforms like SharePoint. The good thing about having a trusted platform in place also is that you can, really post a button there. Like, someone has shared the document with you. Please click here to, to, to, to, make it open. And, that beats a lot of automation that tries to follow these things. And that's why, when you have a, like, regular sandbox in place that just opens and renders the page and most of the things do that, you will get just the, Dropbox, or just OneDrive with the button there. No interaction. You didn't progress further. You didn't get to the attack. You didn't get, the result. And that's why VMRA is different. We we we, really try to click on the things. We can go to the next one. Yeah. My favorite one, probably, CAPTCHAs, and that probably, would be the last example because I want to leave some time to show the tech to you. Yeah. CAPTCHA. Back in the day, we started seeing CAPTCHAs to prove that, we are human. We are, very familiar. We we we, got to the fact that CAPTCHAs exist. They don't raise an eyebrow. Never. Clicking somewhere or checking all the fire hydrants or something else, is really common, for us. Well, obviously, if you just render the page again, within your protection tool, you see the CAPTCHA, which is normal. There is normally shows payload there. So nothing really to, detonate. On top of that, it really expects user to interact. So any sort of automation, that is used for the analysis can stop here. And, in terms of CAPTCHAs, and that's where yeah. If we can go to the next one, Nick, thank you very much. In terms of CAPTCHA, if if I can say it, we we see that the CAPTCHAs themselves has evolved since, their appearance, like, in 2022, 2023. At that time, most of the times, CAPTCHA was used to, just be a protection for their protection is not the right word here. It was a decoy that was used to hide the, phishing page. We saw static, CAPTCHA clones. We saw click to continue CAPTCHA. Like, wherever you click, you just go forward. JavaScript timers with, red flags where you don't need to do anything. The whole thing is just designed to beat the, to, to beat the mail security gateway, that would render the page, see nothing, and then go away. Currently, we see that CAPTCHA is becoming more and more of an of an anti automation filter. They start checking a lot of things. The example here is an example from sneaky to FA, one of the fish kits that is, pretty often used today. They check on many things. They check on, number of plugins within your browser. They check on who is running the browser. They check on how you move the mouse. They check on if you can solve, some tasks like to render something and so on and so forth, general location and, many other things. So basic and yes. What is what is what is very important and very interesting here, CAPTCHA is now very often available as a part of the, Fiskit as well. This one actually came with, sneaky two FA. You, get not only the page but also the protection for that page so that more automation can bypass it and, get to the point. And I guess now if if I'm if I'm allowed to, get the screen and, Oh, yeah? show a couple of examples how we do that, I will probably do this. Just give me a second. How do I share the yeah. I see it. Entire window, and then I want to go into this one. Can you see my screen now? Yes. I wanted to show a couple of recent examples that we see. The point behind the call is that at VMRay, we try to we, believe that to get to the real phishing behavior, you need to, pretend that you're a human. You need to behave like a human. You need to, have a note that looks like a human, like Windows with all the things and so on that's mostly to malware, but also the browser should be very much like a human, driven browser from normal thing that can, run JavaScript, generate pictures, and so on and so forth. So to give you one of the examples, that's something that was submitted into, VMRay a couple of days back. That's a sneaky two FA, which, as I said, is protected by, the fake CAPTCHA. We were able to click on that CAPTCHA, and then after some while, we got the login form, generated. Again, we work to make all the analysis that happens with VMRay automatically. And, yeah, that's that's that's how we want customer journey to be. Of course, clicking things manually is very important, but we want to help SOC teams to scale. And, for that reason, whatever the link or the URL or the file is thrown into the Emery, we do the analysis ourselves with our fake user and fake environments and so on, and you get only the outcome of this analysis. Another example here would be, actually, the, Proton server that drive on the Proton that, shows that a PDF file will share it with you. Of course, something like that was mentioned in the in the original email, which, like, redirects you to the CAPTCHA, which we can beat. It's a CloudFlare, normal CloudFlare one in this example, which reddens you then to the login form and exactly the code that you are expected to to to, to, post here. And then finally, to my initial point, we see a lot of customers submitting into those URLs, but, normally, when you look into the attack vector and you think about how the whole thing made it even made it into my, mailbox. Usually, the attack would look something like that. You get an email with some attachment there, with some URL within this attachment. That's exactly the moment where the URL starts, and then it redirects you somewhere, like, in this example. I don't know. That can be a, click fix or, something else. Yeah. That's a distiller. So, yes, it was a a click fix page with the, distiller that you are downloading in there. Summarizing the tool, VMRay helps you with, with the analysis of the URLs with, beaten, all these decoys and complicated journeys that are put so that you finally get into this phishing kit, generating, this intel on, those attacks. And, yeah, we we are a happy partner of, and I think I've I've I've spoken enough, and I'm passing over to Nick. Awesome. I appreciate it, Andre. And because I promoted Flare and I showed you how, like, we do the you know, we intercept the login and we, we try and prevent the credential the phishing, from working. I analyze a lot of phishing domains in VMRay, and I have never it has never, the phishing page has never detected that I'm analyzing it, which sometimes they you know, I've used many, sand many of sandbox before, and they try to evade them, of course, with, a million different creative things. It's never happened to me, in VM ring, and I'm always able to get something interesting, out of the page. And the the sandbox inside of Flare, obviously, as is well documented, is, is VMRay powered. So we, we're we're super proud of this partnership, and and it's been an awesome one so far. Now we should leave the remainder of the time, for questions. I'm sure there's a lot, of really good ones from the chat. Joe, I don't know if there's any you want to call out, and not Joe Coleman, though. Thank you for your amazing questions, Joe Coleman. You can call out more questions, by the way. But Joe Murphy from our side or Andre, if you saw any in the chat you wanna address, feel free to post more. And I will scroll through now and try and find some interesting ones. Yeah. I see a comment from, Jordan, on, malicious PowerShell script. I guess that's exactly what happened here in my example. Let me just pivot there while you are looking for the question. Yeah. That's a pretty familiar technique these days when you are presented. It's it's not a fish kit related thing, and I like I would say that, honestly, I'm super surprised that this thing even works at all, but users tend to really hit Windows and then r and then control v and then enter. We see these days, click fix that is aware of the operating system that is utilized on the on the victim's endpoint. They show you different text and different, and they give you different scripts, obviously, PowerShell or, common shell scripts, like, really depending on whether you are a Mac user or a Windows user. Yeah. It is shocking that that works, but maybe it shouldn't be. This is the this is we we it's like it's surprising, but it should be unsurprising. Denise asked the solution for this. You asked this at 01:30. So when I was presenting, probably something with device codes in it. The solution for this is revoking sessions. Right? Yes, Denise. The that is one of the answers. So first of all, banning device code authentication altogether or or registering devices for, like, most of your user groups is a great idea. You shouldn't let that happen, but there's other you know, there that's not the only phishing, method that I've, shown or that, Andre sees in the wild all the time. So revoking sessions when, you know, in flare, yes, when we when we in fact, that's something we do. When we observe this activity, when we see a a notification or a phishing kit message that indicates someone's token, device code, or username and password have been stolen, we offer the ability for users to automatically revoke the sessions or mark the account as compromised, which, will let lets you through conditional access policies, which someone said is the only way to prevent this conditional access policies. Yes. That is one thing you should be using here. Definitely. You can, you know, from Flare, we can mark it as compromise, and then you can use conditional access policies to specify exactly what you'd like that conditional access policy to do when you see it, happening. And Evan said, are most of these kits using Telegram bots to notify users? Are their dashboards mainly used to create new campaigns? Yeah. Yes. I think Telegram is super popular. There are some of them don't use any kind of external messaging, or let the user customize it, but definitely, Telegram continues to be very popular in every every corner of cybercrime from stealer logs to casual conversations to many different flavors of malware, to phishing kits. So, definitely, Telegram is popular here. Will these automated efficient kits work with any platforms beyond Microsoft software suites? Yeah. There are kits designed to be more, agnostic. And, like, I've seen a lot of kits that target, you know, g Suite and, are built specifically for g Suite, proxying or or with fake g Suite login portals, and then they'll do all the relay and cookie testing on their own. But, yeah, totally. There are there are, automated phishing kits that work beyond these, but, you know, dramatic majority of enterprise, users and especially the enterprises that these people are interested in targeting are gonna are gonna have some Microsoft suite in use and probably manage identities, and federate identities through, Entra. So it's it's why it's the most targeted, but totally, there's phishing kits that are that are a little more agnostic, or that allow you to be more customizable in exactly what you'd like to, harvest. Joe Coleman said Telegram equals LinkedIn for bad guys. That is funny and true. I think it's the it's kind of the everything for bad guys. It's where they chat. It's, it's where they sell things. It's, it's like it's it's it's everything. But forums are also the LinkedIn for bad guys, definitely. That's where they have, like, their own little profiles with their stats on them and stuff. Messaging in Telegram is more convenient than in the LinkedIn. Oh, yeah. And it has free file uploads, which is very convenient. Important. Yep. Philip, you're so welcome. Thank you for attending. I really appreciate it. Awesome. We are we are at time. So, again, there oh, there's a few in the q and a. I'll see if I can get to them. Solutions for working sessions. I got to that. There are many kid Telegram bots. Got to that. What are situations when a hacker is able to send many emails to one company? That's when when they well, when you take over an inbox, when you take over an account, you you've, you know, when you use one of these kits to take over an account, you own the account. So, you can, send an email as the user to the whole company. Most of the kit operators we see are a little lower and slower than that, but, I'm I'm sure I'm sure it's it happens occasionally, but I can't say I've seen examples of, sort of brazen, like, sending a company wide email type things from from EfficientKit. But they definitely send lures around as the trusted user internally to get to harvest other credentials and, or other, device codes or, access tokens and move laterally. So cool. We are at time. Thank you all so much for attending. I I hope it was interesting. Thank you, Andre, for, for for putting in the work on this and sharing all the cool stuff from VM. And, we have more webinars coming up. We have the Flare Academy Discord. Please, please check that out. Join the community and chat with us, chat with us over there. There will be a recording shared shared in the discord of this presentation. If you wanna go back and look at at anything and, or have any questions, please feel free to reach out. And that's it. So thanks again, and, we'll see you on the next one. Thank you.