Full Report
From fake UPS shipping notifications to PayPal-themed callback phishing, here are the five top phishing techniques we’re seeing this year.
Analysis Summary
# Tool/Technique: Raccoon0365 (Phishing-as-a-Service Kit)
## Overview
Raccoon0365 is a sophisticated Phishing-as-a-Service (PhaaS) kit designed primarily to harvest Microsoft 365 credentials. It is frequently delivered via voicemail-themed lures and utilizes automated techniques to increase the credibility of its landing pages to deceive corporate users.
## Technical Details
- **Type:** Phishing-as-a-Service (PhaaS) / Phishing Kit
- **Platform:** Web-based (Targeting Microsoft 365 users)
- **Capabilities:** Credential harvesting, automated victim pre-population, bypass of Email Security Gateways (ESG).
- **First Seen:** Active in current 2024-2025 campaigns.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.001 - Phishing: Spearphishing Attachment] (SVG/HTML files)
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1539 - Steal Web Session Cookie]
- [T1212 - Exploitation for Credential Access]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information] (SVG obfuscation)
## Functionality
### Core Capabilities
- **Credential Harvesting:** Captures usernames and passwords via highly accurate clones of the Microsoft login interface.
- **Dynamic Pre-population:** The kit can automatically extract the victim's email address from the URL or metadata and pre-fill the login field, reducing friction and increasing the "official" appearance of the site.
- **Attachment Variation:** Supports multiple delivery formats including SVG, HTML, HTA, and LNK files to evade static file scanners.
### Advanced Features
- **SVG Obfuscation:** The kit uses obfuscated code within Scalable Vector Graphics (SVG) files. Since SVGs are XML-based, they can execute JavaScript or redirect browsers while often bypassing traditional email filters that scan for malicious PE files or simple URLs.
- **Evasion Techniques:** Employs redirection chains to hide the final destination of the phishing landing page from automated crawlers.
## Indicators of Compromise
- **File Hashes:** *(Specific hashes not provided in article; common for kit-generated files to have unique hashes per campaign)*.
- **File Names:** `Voicemail_Transcript.svg`, `missed_call.html`, `Office_Voice_Msg.lnk`.
- **Network Indicators:**
- Landing pages often hosted on compromised legitimate sites or low-reputation TLDs.
- Defanged Example: `hxxps[:]//raccoon-login-microsoft[.]com/` (Example pattern).
- **Behavioral Indicators:**
- Browser opening an SVG file that immediately triggers a meta-refresh or JavaScript redirect to a third-party domain.
- Outbound traffic to known Phishing-as-a-Service backend APIs.
## Associated Threat Actors
- Used by various unaffiliated cybercriminal affiliates subscribing to the Raccoon0365 kit.
- Related Kits: **Kali365**, **Octopi365** (often share similar codebases or infrastructure patterns).
## Detection Methods
- **Signature-based detection:** Scanning for specific XML tags and obfuscated script blocks within SVG and HTML attachments.
- **Behavioral detection:** Monitoring for "Living off Trusted Sites" (LoTS) behavior, where phishing links are hosted on legitimate services like Tencent Cloud, Dropbox, or Shopify.
- **YARA rules:** Targeting the specific obfuscation routines used in the Raccoon0365 SVG templates.
## Mitigation Strategies
- **Prevention measures:** Implementation of FIDO2-compliant hardware security keys to mitigate credential replay.
- **Hardening recommendations:**
- Disable the opening of SVG files by default in web browsers or email clients.
- Configure Email Security Gateways to quarantine attachments with active content (HTML/SVG).
- **User Education:** Train users to recognize "Callback Phishing" and voicemail lures that require downloading files to "listen" to messages.
## Related Tools/Techniques
- **Callback Phishing:** The use of phone numbers in emails to initiate the attack.
- **Kali365 / Octopi365:** Similar kits specialized in Token Theft and MFA bypass.
- **Device Code Phishing:** A technique used by similar kits to abuse the Microsoft Device Code flow.