New V3B phishing kit targets customers of 54 European banks
by nlqip
![Phishing](https://kartwheelnewz.info/wp-content/uploads/2024/06/New-V3B-phishing-kit-targets-customers-of-54-European-banks.jpg)
Cybercriminals are promoting a new phishing kit named ‘V3B’ on Telegram, which currently targets customers of 54 major financial institutes in Ireland, the Netherlands, Finland, Austria, Germany, France, Belgium, Greece, Luxembourg, and Italy.
The phishing kit, priced between $130-$450 per month depending on what is purchased, features advanced obfuscation, localization options, OTP/TAN/2FA support, live chat with victims, and various evasion mechanisms.
According to Resecurity researchers who discovered V3B, its Telegram channel already counts over 1,250 members, indicating the new phishing-as-a-service (PhaaS) platform is quickly gaining traction in the cybercrime space.
![Phishing kit promoted on Telegram](https://www.bleepstatic.com/images/news/u/1220909/2024/Phishing/13/telegram.png)
Source: Resecurity
V3B features
V3B uses heavily obfuscated JavaScript code on top of a custom CMS to evade detection by anti-phishing and search engine bots and protect from researchers.
It includes professionally translated pages in multiple languages like Finnish, French, Italian, Polish, and German to enhance the effectiveness of the phishing attacks, allowing threat actors to run multi-country campaigns.
The kit, which is designed to work on both mobile and desktop platforms, can intercept banking account credentials and information, as well as credit card details.
Additionally, the admin panel (uPanel) allows fraudsters to interact with victims in real time via a chat system to obtain one-time passwords (OTPs) by sending custom notifications.
![Live chat feature enabling real-time interactions](https://www.bleepstatic.com/images/news/u/1220909/2024/Phishing/13/livechat.png)
Source: Resecurity
Stolen information is transmitted back to the cybercriminals through the Telegram API.
Among the real-time interaction trigger options, there is a QR code login jacking feature that enables cybercriminals to generate QR codes for phishing pages, taking advantage of a false sense of legitimacy stemming from the victim’s familiarity with trusted services using that method.
Another notable feature of the V3B kit is support for PhotoTAN and Smart ID to bypass advanced authentication technologies that German and Swiss banks widely use.
“Technologies used for customer authentication by banks may vary,” explains Resecurity.
“However, the fact that fraudsters have started to implement support of alternative OTP/TAN validation mechanisms, rather than relying solely on traditional SMS-based methods, may confirm the challenges that fraud prevention teams will face in combating account takeover for both private and corporate customers.”
Phishing kits are key enablers of cybercrime, allowing low-skilled threat actors to launch highly damaging attacks against unsuspecting bank customers.
One of the largest PhaaS operations out there, LabHost, which targeted mainly U.S. and Canadian banks, was recently taken down by law enforcement authorities.
Thirty-seven people, including the original developer, were arrested in the law enforcement operation.
At the time of its bust, LabHost had 10,000 users worldwide, launching phishing attacks through 40,000 domains.
Source link
lol
Cybercriminals are promoting a new phishing kit named ‘V3B’ on Telegram, which currently targets customers of 54 major financial institutes in Ireland, the Netherlands, Finland, Austria, Germany, France, Belgium, Greece, Luxembourg, and Italy. The phishing kit, priced between $130-$450 per month depending on what is purchased, features advanced obfuscation, localization options, OTP/TAN/2FA support, live chat with victims,…
Recent Posts
- Bitcoin ATM scams skyrocket – Week in security with Tony Anscombe
- North Korean Threat Actors Deploy COVERTCATCH Malware via LinkedIn Job Scams
- FBI Cracks Down on Dark Web Marketplace Managed by Russian and Kazakh Nationals
- ESET Research Podcast: HotPage
- A Vulnerability in SonicWall SonicOS Management Access and SSLVPN Could Allow for Unauthorized Resource Access