A new phishing kit that is rapidly gaining significant traction among cybercriminals has been discovered by cybersecurity researchers at Resecurity.
V3B can cost anywhere from USD 130-450 a month, depending on the feature pack that the customer chooses, with the developers promoting it in a Telegram group that swiftly grew to include over 1,250 members.
An assortment of software tools and resources used by cybercriminals to initiate phishing attacks is called a phishing kit. These kits make it simpler for attackers to trick users into divulging sensitive information by streamlining the process of developing and overseeing phishing campaigns.
Phishing often consists of two parts: a landing page (often a spoof login page from a well-known service like Google or Office365) where sensitive login credentials are harvested, and an email that coerces the victim into responding quickly.
Grabbing One-Time Passwords
V3B specialises in creating high-quality templates that closely resemble popular websites and services. These templates are built using complex JavaScript code within a customised content management system (CMS), effectively bypassing detection from various anti-phishing and search engine bots. The landing pages are also available in multiple languages, such as Finnish, French, Italian, Polish, and German.
According to reports, its users are presently pretending to be 54 well-known financial institutions from Ireland, the Netherlands, Finland, Austria, Germany, France, Belgium, Greece, Luxembourg, and Italy. As a second line of defence, the majority of financial institutions these days demand multi-factor authentication or one-time passwords, though.
V3B can also get around this since it has an admin panel (uPanel) that lets scammers use a chat interface to communicate with their victims. They can fool the victims into disclosing the codes in this way, and it seems that the ruse is effective.
Last but not least, the kit is made to function on desktop and mobile devices.
“Technologies used for customer authentication by banks may vary. However, the fact that fraudsters have started to implement support of alternative OTP/TAN validation mechanisms, rather than relying solely on traditional SMS-based methods, may confirm the challenges that fraud prevention teams will face in combating account takeover for both private and corporate customers,” the researchers said.