"Criminals can more easily pull off social engineering scams and other forms of identity fraud thanks to custom voice-phishing kits being sold on dark web forums and messaging platforms. These kits are sold as a service to "a growing number" of digital intruders targeting victims' Google, Microsoft, and Okta accounts, and they include real-time assistance to miscreants looking to intercept users' credentials and multi-factor authentication codes, according to a Thursday Okta Threat Intelligence blog."
""The phishing kits have been developed to closely mimic the authentication flows of identity providers and other identity systems used by organizations," he said. "The kits allow the attacker to monitor the phishing page as the targeted user is interacting with it and trigger different custom pages that the target sees. This creates a more compelling pretext for asking the user to share credentials and accept multi-factor authentication challenges.""
Custom voice-phishing kits are being sold on dark web forums and messaging platforms as a service that provides real-time assistance to attackers. The kits mimic authentication flows of identity providers and identity systems, allowing attackers to monitor the phishing page while the target interacts and to display different custom pages. Attackers use the kits to intercept credentials and multi-factor authentication codes and to create convincing helpdesk or support-ticket pretexts. Some ads recruit native English-speaking callers to perform live social-engineering calls. Reconnaissance on targets exposes names, apps used, and support phone numbers to enable coordinated credential and MFA interception.
Read at Theregister
Unable to calculate read time
Collection
[
|
...
]