Phishing campaigns have always been a threat, but a new toolkit called FishXProxy is making it alarmingly easy for even inexperienced cybercriminals to carry out sophisticated scams.
SlashNext Email Security researchers have disclosed exclusive details about FishXProxy, a new phishing kit that was found on the Dark Web, in their most recent report. With its advanced features like antibot setups, Cloudflare Turnstile integration, an integrated redirector, and page expiration settings, FishXProxy is an end-to-end solution that lowers the bar for cybercriminals.
The kit is advertised as "The Ultimate Powerful Phishing Toolkit," since it can simply neutralise technical hurdles associated with phishing campaigns, allowing cybercriminals to launch attacks that bypass security defences and go undetected. FishXProxy is especially damaging because it makes phishing possible for individuals with limited technology expertise. It is a comprehensive solution for creating and managing phishing sites in order to avoid detection and increase the success rate of credential theft attempts.
“FishXProxy equips cybercriminals with a formidable arsenal for multi-layered email phishing attacks…Even if one attack fails, cross-project tracking allows attackers to persistently target victims across multiple campaigns,” SlashNext’s researchers stated in their report.
Using this kit, phishing emails with unique links and dynamic attachments can avoid security checks. Advanced anti-bot technology discards automated scanning and potential victims. Worse, FishXProxy includes traffic management features that mask the true destination of links and distribute traffic across multiple pages. Short-lived frauds can also be made to expire after a certain amount of time, putting pressure on victims to act fast. A cookie system enables attackers to identify and target users across many campaigns, personalising schemes and creating profiles of subsequent victims.
Mr Mika Aalto, Co-Founder and CEO of Hoxhunt, a Helsinki-based Human Risk Management Platform, commented on the recent trend, stating that phishing kits make it easy for even less competent and resource-limited criminals to carry out advanced phishing attacks.
“Phishing kits are lowering the barrier of entry to advanced cybercrime even for low-resourced and not clever criminals. As more phishing attacks consequently bypass filters, we need to make sure our people are equipped with the skills and tools to keep themselves and their colleagues safe,“ Aalto noted.
To mitigate this threat, organisations require modern security solutions that can detect threats through numerous channels. Employees should also be trained on the most recent phishing techniques, and strong authentication protocols should be established.