The Fall of LabHost: Law Enforcement Shuts Down Phishing Service Provider


In late 2021, LabHost (AKA LabRat) emerged as a new PhaaS platform, growing over time to eventually offer dozens of phishing pages targeting banks, high-profile organizations, and other service providers located around the world, but most notably in Canada, the US, and the UK.

The popularity of the platform meant that at the time of the takedown, it boasted more than 2,000 criminal users, who had used it to deploy over 40,000 fraudulent sites leading to hundreds of thousands of victims worldwide. The platform offered a number of key benefits to its criminal clientele, including: The ability to obtain two-factor authentication (2FA) codes by proxying the connection to the phished organization using Adversary-in-the-Middle (AitM) techniques.

Read more…
Source: Trend Micro


Sign up for our Newsletter


Related:

  • LevelBlue Labs Discovers Highly Evasive, New Loader Targeting Chinese Organizations

    June 19, 2024

    LevelBlue Labs recently discovered a new highly evasive loader that is being delivered to specific targets through phishing attachments. A loader is a type of malware used to load second-stage payload malware onto a victim’s system. Due to the lack of previous samples observed in the wild, LevelBlue Labs has named this malware “SquidLoader,” given its ...

  • Fickle Stealer Distributed via Multiple Attack Chain

    June 19, 2024

    The past few years have seen a significant increase in the number of Rust developers. Rust is a programming language focused on performance and reliability. However, for an attacker, its complicated assembly code is a significant merit. In May 2024, FortiGuard Labs observed a Rust-based stealer. In addition to its intricate code, the stealer is distributed ...

  • Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 C&C Framework

    June 19, 2024

    In early April, Trend Micro researchers discovered that a new threat actor group (which they call Void Arachne) was targeting Chinese-speaking users. Void Arachne’s campaign involves the use of malicious MSI files that contain legitimate software installer files for artificial intelligence (AI) software as well as other popular software. The malicious Winos payloads are bundled alongside ...

  • Unmasking Mac malware – strategies for a growing threat

    June 18, 2024

    In recent years, cybercriminal groups have been ramping up their efforts to find vulnerabilities and create malware that will exploit the iOS or macOS. Jamf’s latest annual threat landscape research tracked 300 malware families designed for macOS, and 21 newly created families in 2023. It’s not just the number of malware families that has risen, but ...

  • Finland sees record number of data breach reports in 2023

    June 18, 2024

    A record high number of data breaches were reported to Finland’s Data Protection Ombudsman last year, according to a report by news group Uutissuomalainen. In total, the office received 6,900 data breach reports in 2023, an increase of 1,400 on the figure for 2022. Assistant Data Protection Ombudsman Heljä-Tuulia Pihamaa told Uutissuomalainen that the sharp rise ...

  • Hackers are using fake Chrome, Word and OneDrive errors to trick people into installing malware

    June 17, 2024

    Proofpoint has observed an increase in a technique leveraging unique social engineering that directs users to copy and paste malicious PowerShell scripts to infect their computers with malware. Threat actors including initial access broker TA571 and at least one fake update activity set are using this method to deliver malware including DarkGate, Matanbuchus, NetSupport, and various ...