Software for sale is fueling a torrent of phishing attacks that bypass MFA

Microsoft on Tuesday profiled software being sold on online forums. This makes it easy for criminals to deploy phishing campaigns that successfully compromise accounts, even those protected by the most common forms of multi-factor authentication.

Phishing kits are the engine behind more than one million malicious emails sent each day, say researchers from the Microsoft Threat Intelligence team. Priced at $300 for the standard version and $1,000 for VIP users, the software offers a range of advanced features to streamline the deployment of phishing campaigns and increase the likelihood of bypassing anti-phishing defenses.

One of the most prominent features is the built-in ability to bypass some forms of multi-factor authentication. Also known as MFA, two-factor authentication, or 2FA, this protection allows account holders to prove their identity using something that belongs to them (such as a security key or authenticator app) or something that is unique to them, rather than just a password. need to do it. (such as fingerprints or face scans). MFA has become the primary defense against account takeover. Stealing passwords is not enough for an attacker to gain control.

The Achilles Heel in MFA: TOTP

The effectiveness of MFA has not gone unnoticed by phishers. Several campaigns uncovered in recent months have highlighted vulnerabilities in MFA systems that use TOTP, which stands for time-based one-time passwords generated by authenticator apps. One of his campaigns, disclosed by Microsoft, targeted more than 10,000 organizations in 10 months. Another successfully compromised the network of security firm Twilio. Similar to the phishing kit Microsoft detailed on Tuesday, his two campaigns above used a technique known as AitM, short for adversary in the middle. It works by placing a phishing site between the targeted user and the site the user is trying to log into. When a user enters a password on the fake site, the fake site relays it to the real site in real time. When the real site responds with her TOTP prompt, the fake site receives the prompt and also returns it to the target in real time. When the target enters her TOTP into the fake site, the fake site sends it to the real site.

To ensure that TOTPs are entered within a time limit (usually around 30 seconds), phishers use Telegram-based bots and other real-time messengers that quickly and automatically fill in credentials. Once processed, the real site sends an authentication cookie to the fake site. Phishers now have everything they need to take over accounts.

Last May, the criminal group tracked by Microsoft as DEV-1101 began promoting a phishing kit that defeats not only MFA based on one-time passwords, but also other widely used automated defenses. bottom. One feature injects her CAPTCHA into the process to allow human-operated browsers to access the final phishing page, but automated defenses cannot. Another feature temporarily redirects the targeted browser from the first link in the phishing email to a benign site before reaching the phishing site. Redirects help defeat blocklists of known malicious URLs.

Ads that began appearing last May described the kit as a phishing application written in NodeJS that offered PHP reverse proxy functionality to bypass MFA and CAPTCHA, and redirects to bypass other defenses. was Ads promote other features such as automatic setup and various pre-installed templates to mimic services like Microsoft Office and Outlook.

“These attributes make Kit attractive to many different actors who have been using it continuously since it became available in May 2022,” Microsoft researchers wrote. “Actors using this kit have different motives and targets, potentially targeting any industry or sector.”

This post lists some countermeasures customers can use to combat kit evasions, such as Windows Defender and anti-phishing solutions. Unfortunately, this post glosses over the most effective means of MFA, which is based on an industry standard known as FIDO2. So far, no known credential phishing attacks have defeated FIDO2, making it one of the most effective barriers to account takeover.

For more information on FIDO2-compliant MFA, see our previous articles here, here, and here.

The phishing attack that compromised Twilio’s network worked because one of the targeted employees entered a TOTP generated by the authenticator into the attacker’s fake login site. The same campaign failed against his Cloudflare content delivery network because the company was using his FIDO2-based MFA.