Hackers are selling a phishing-as-a-service (PhaaS) toolkit called SessionShark 0365 2FA/MFA on underground hacking forums. This toolkit, intended for use only in educational purposes, can be used to steal user session tokens and bypass two-factor authentication on Office 365 accounts.
The ad, spotted by SlashNext researchers, claims that the toolkit can “intercept sensitive data, including login credentials and session cookies”. Other capabilities include evasion of bots and automated security scanners, Cloudflare compatibility for VPS IP protections, detection evasion from major threat intelligence tools and anti-phishing systems, and dynamic changes to the phishing page for increased believability.
Threat evasion is handled by custom scripts and HTTP headers that minimise the script’s visibility to security programs. The kit likely blocks known threat intelligence crawlers using “evasive HTML/JS code (to prevent signature-based detection), or dynamically change content,” according to SlashNext’s report.
The phishing pages also have a set of scripts to make them as convincing as possible. Given the threat actors’ claims of the page dynamically adapting to “various conditions,” it’s likely that the pages handle different login workflows and error messages as well.
Last but not least, the toolkit includes a logging panel and Telegram integration for its operators. This feature lets hackers receive stolen credentials and session tokens in real time on Telegram, a rather convenient way of data extraction and one that’s popular in similar phishing kits.
The “educational” tag also doesn’t mean anything. The disclaimer is only to absolve the creators of any responsibility should someone using the kit get in trouble with law enforcement. SessionShark has a well-defined terms of service document that clearly states that the creators of the kit don’t take responsibility for any damage caused by the toolkit. Additionally, if someone is caught using the kit for malicious purposes, their account will be suspended without a refund.
In the News: Cybercriminals are using the Pope’s death to preach malware
