Full Report
Group-IB researchers uncovered a professional phishing framework that mimics trusted brands with remarkable precision. Using layered evasion, CAPTCHA filtering, and Telegram-based data exfiltration, attackers harvest credentials and bypass automated detection. The findings highlight how phishing-as-a-service operations are scaling through automation, lowering technical barriers for cybercriminals, and industrializing one of the oldest yet most effective forms of digital fraud.
Analysis Summary
# Tool/Technique: Professional Phishing-as-a-Service (PhaaS) Framework
## Overview
This is a highly automated, professional phishing framework sold as a service (PhaaS). Its purpose is to industrialize credential theft by mimicking trusted brands (such as Aruba) with high precision. The framework utilizes sophisticated evasion techniques to bypass automated security scanners and filters, ultimately exfiltrating stolen data via Telegram.
## Technical Details
- **Type:** Phishing-as-a-Service (PhaaS) / Tool
- **Platform:** Web-based (Targeting end-user browsers and mobile devices)
- **Capabilities:** Layered evasion, CAPTCHA filtering, real-time credential harvesting, Telegram-based exfiltration, and brand impersonation.
- **First Seen:** Targeted activity identified in 2024 (Group-IB report date context).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0007 - Discovery]**
- [T1614 - System Location Discovery] (Geofencing/IP filtering)
- **[TA0005 - Defense Evasion]**
- [T1564 - Hide Artifacts]
- [T1205 - Traffic Signaling] (Use of CAPTCHAs to block automated scanners)
- **[TA0010 - Exfiltration]**
- [T1567 - Exfiltration Over Web Service] (Telegram API)
## Functionality
### Core Capabilities
- **Brand Mimicry:** High-fidelity replication of brand assets, CSS, and login workflows (specifically targeting Italian provider Aruba in this instance).
- **Credential Harvesting:** Captures usernames, passwords, and potentially PII in real-time.
- **Data Exfiltration:** Uses Telegram bots to send stolen credentials directly to the attacker, avoiding traditional C2 infrastructure that might be easily flagged.
### Advanced Features
- **Layered Evasion:** Implements sophisticated filtering to distinguish between real users and security crawlers/bots.
- **CAPTCHA Filtering:** Forces a CAPTCHA challenge before showing the phishing content. This prevents automated analysis tools (which often cannot solve CAPTCHAs) from seeing the malicious payload.
- **Geofencing:** Restricts access to specific geographic regions or IP ranges to stay under the radar of global security monitoring teams.
- **Industrialized Automation:** Lowered technical barriers through a "Plug-and-Play" interface for low-skill cybercriminals.
## Indicators of Compromise
### Network Indicators
- serdegogozedeytid[.]bulkypay[.]xyz (23[.]239[.]109[.]118)
- serdegogozedeytidtelerstore[.]marina[.]am (192[.]250[.]229[.]24)
- scarecrow[.]metalseed[.]you2[.]pl (109[.]95[.]159[.]70)
- wordpress-1512889-5811853[.]cloudwaysapps[.]com (45[.]77[.]157[.]140)
- firsijdaeeuetevcbcsj[.]cfolks[.]pl (185[.]208[.]164[.]121)
- arb-app[.]nero-network[.]eu (185[.]25[.]23[.]155)
- srv229641[.]hoster-test[.]ru (31[.]28[.]24[.]131)
## Associated Threat Actors
- Distributed via various **Cybercrime-as-a-Service** affiliates (Specific group names not provided in the snippet).
## Detection Methods
- **Behavioral Detection:** Monitor for outgoing traffic to Telegram API (`api.telegram.org`) from unexpected web server processes.
- **URL Analysis:** Look for subdomains mimicking known brands on low-reputation Top-Level Domains (TLDs) like `.xyz`, `.am`, or `.pl`.
- **Traffic Analysis:** Identification of unusually high volumes of CAPTCHA requests on non-functional or newly registered domains.
## Mitigation Strategies
- **For Organizations:**
- Implement Zero-Trust architectures and continuous traffic monitoring.
- Proactively monitor for look-alike domains and request takedowns.
- Use Multi-Factor Authentication (MFA) with a preference for hardware keys or Passkeys over SMS.
- **For Users:**
- Verify senders and inspect URLs manually by hovering over links.
- Use password managers to identify legitimate vs. fraudulent domains (managers won't auto-fill on fake sites).
- Avoid clicking links in urgent or threatening emails; instead, navigate directly to the official website.
## Related Tools/Techniques
- **Adversary-in-the-Middle (AiTM):** Phishing kits that proxy traffic in real-time.
- **Telekopye:** Another Telegram-based phishing toolkit used by cybercriminals.
- **Evilginx2:** A popular framework for bypassing MFA via session cookie theft.