Full Report
Hackers getting better at their tradecraft and their skills are becoming more and more accessible to other bad actors via the Dark Web.
Analysis Summary
# Tool/Technique: Phishing-as-a-Service (PhaaS) & Credential Brokering
## Overview
This technique involves the commercialization and specialization of phishing operations within underground marketplaces. Instead of a single actor performing all stages of an attack, the process is fragmented: developers sell high-quality fake login templates, while Initial Access Brokers (IABs) sell bulk-harvested credentials. This "as-a-service" model lowers the barrier to entry for less skilled actors to compromise enterprise environments like Microsoft/Office 365.
## Technical Details
- **Type:** Technique / Cybercrime Infrastructure
- **Platform:** Web-based (SaaS), Windows (Office 365), Multi-platform (Banking/Social Media)
- **Capabilities:** Credential harvesting, 2FA/MFA bypass (via session injects), automated log delivery, administrative panel access.
- **First Seen:** Historically active; specific forum activity highlighted from 2020.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566 - Phishing]
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1589.001 - Gather Victim Identity Information: Credentials]
- [T1078 - Valid Accounts]
- **[TA0007 - Discovery]**
- [T1087.003 - Account Discovery: Email Account]
## Functionality
### Core Capabilities
* **Fake Login Pages:** Custom-built HTML templates mimicking Microsoft 365, banks, and social media to trick users into entering credentials.
* **Automated Log Exfiltration:** Scripts integrated into phishing pages that automatically email captured "logs" (usernames/passwords) to the attacker.
* **Credential Brokering:** Sale of pre-validated account lists in bulk (e.g., $2 per account) often sorted by target industry or access level.
### Advanced Features
* **Administrative Access Identification:** Higher-tier offerings include accounts pre-verified for Global Administrator or billing privileges.
* **Commercial Marketing Tactics:** Sellers use "thread bumping," limited-time discounts, and bulk-buy incentives to attract buyers on dark web forums like XSS.
* **Infrastructure Injects:** Sophisticated templates capable of injecting malicious code or intercepting session tokens.
## Indicators of Compromise
* **File Names:** `Office365_login.html`, `login_verify.php` (Common naming conventions in kits).
* **Network Indicators:**
* `xss[.]is` (Underground forum source).
* `nbstelecom[.]com[.]br` (Reported compromised ISP infrastructure).
* **Behavioral Indicators:**
* Logins from unusual geographic locations or known VPN/Tor exit nodes.
* Creation of new inbox rules (forwarding/deletion) immediately following a successful login.
## Associated Threat Actors
* **Initial Access Brokers (IABs):** Specialized actors who harvest and sell access.
* **Unspecified Dark Web Vendors:** Users on forums such as XSS and BreachForums.
## Detection Methods
* **Behavioral Detection:** Monitor for "impossible travel" logins and unusual OAuth application registrations within the O365 tenant.
* **Email Security:** Use DMARC, SPF, and DKIM to prevent domain spoofing; deploy AI-based email security to detect brand impersonation in phishing links.
* **Log Analysis:** Audit Microsoft Entra ID (Azure AD) logs for unauthorized password resets or changes to Multi-Factor Authentication (MFA) methods.
## Mitigation Strategies
* **Enforce MFA:** Implement Phishing-Resistant MFA (FIDO2/WebAuthn) to negate the effectiveness of harvested passwords.
* **Conditional Access Policies:** Restrict logins to known managed devices or specific geographic regions.
* **Security Awareness Training:** Educate users on identifying sophisticated fake login portals and the risks of entering credentials into non-standard prompts.
* **Credential Monitoring:** Use dark web monitoring services to identify if corporate credentials are being sold in bulk lists.
## Related Tools/Techniques
* **Business Email Compromise (BEC):** The primary goal following the purchase of these credentials.
* **Adversary-in-the-Middle (AiTM):** Advanced phishing kits (like Evilginx2) that automate the capture of session cookies.