The Fall of LabHost: Law Enforcement Shuts Down Phishing Service Provider


In late 2021, LabHost (AKA LabRat) emerged as a new PhaaS platform, growing over time to eventually offer dozens of phishing pages targeting banks, high-profile organizations, and other service providers located around the world, but most notably in Canada, the US, and the UK.

The popularity of the platform meant that at the time of the takedown, it boasted more than 2,000 criminal users, who had used it to deploy over 40,000 fraudulent sites leading to hundreds of thousands of victims worldwide. The platform offered a number of key benefits to its criminal clientele, including: The ability to obtain two-factor authentication (2FA) codes by proxying the connection to the phished organization using Adversary-in-the-Middle (AitM) techniques.

Read more…
Source: Trend Micro


Sign up for our Newsletter


Related:

  • Hackers are using fake Chrome, Word and OneDrive errors to trick people into installing malware

    June 17, 2024

    Proofpoint has observed an increase in a technique leveraging unique social engineering that directs users to copy and paste malicious PowerShell scripts to infect their computers with malware. Threat actors including initial access broker TA571 and at least one fake update activity set are using this method to deliver malware including DarkGate, Matanbuchus, NetSupport, and various ...

  • Keytronic confirms data breach after Black Basta ransomware gang strikes again

    June 17, 2024

    Hardware firm Keytronic has confirmed a significant data breach weeks after the Black Basta ransomware group leaked over 500GB of the company’s stolen data around two weeks ago. The company, known for its printed circuit board assembly (PCBA), reported the cyberattack in an SEC filing over a month ago on May 6 – the attack was ...

  • Malvertising Campaign Leads to Execution of Oyster Backdoor

    June 17, 2024

    Rapid7 has observed a recent malvertising campaign that lures users into downloading malicious installers for popular software such as Google Chrome and Microsoft Teams. The installers were being used to drop a backdoor identified as Oyster, aka Broomstick. Following execution of the backdoor, we have observed enumeration commands indicative of hands-on-keyboard activity as well as the ...

  • Philippines Maritime Industry Authority web-based systems hit by cyber attack

    June 17, 2024

    Four web-based systems belonging to the Maritime Industry Authority (MARINA) were “attacked and compromised” on Sunday, MARINA said Monday. MARINA said it deployed its concerned officials and employees to its Central Office to “to implement expeditious measure to ensure the protection of the integrity of the systems.” Read more… Source: MSN News Sign up for our Newsletter Related:

  • Cleveland City Hall to remain closed after ransomware attack

    June 15, 2024

    City officials have confirmed the “cyber incident” that has hamstrung city operations for days to be a ransomware attack. In such attacks, malicious software effectively locks up a computer or network system, preventing access until users pay a ransom, according to the FBI. Read more… Source: MSN News Sign up for our Newsletter Related:

  • Data of over 20,000 staff, students at Chinese University of Hong Kong stolen after school server hacked

    June 14, 2024

    The personal data of over 20,000 Chinese University of Hong Kong (CUHK) staff and students has been stolen after a server at one of the institution’s schools was hacked. The server of an online learning system used by CUHK’s School of Continuing and Professional Studies (CUSCS) was hacked on June 3, the school announced in a ...