Phishing Kit.

What is a phishing kit?

A phishing kit is a ready-to-use bundle that helps someone run a phishing scam. Phishing is a fraud technique that tricks people into giving away sensitive data. In a report on phishing trends, US-CERT, part of CISA, says kits contain items such as pre-generated HTML pages and emails for popular banks and online commerce sites. The same report lists scripts for processing user input, email and proxy server lists, and even hosting services for phishing sites.

How does a phishing kit work?

The kit gives a criminal most of the parts of a scam in one package. The pages look like a well-known site, and the scripts handle what a victim types in. MITRE ATT&CK also describes how adversaries clone legitimate sites to use as the target of a link. It says this can include cloning login pages of legitimate web services or of an organization.

The US-CERT report says kits were traditionally bought and sold by criminals in the underground economy. It also says versions were found that anyone could download at no cost.

Why does it matter?

US-CERT says phishing kits provide a lower barrier to entry for criminals and reduce the technical knowledge needed to run a phishing scam. Reasoning cautiously, that can mean more people are able to run scams. MITRE says adversaries may clone legitimate login pages, so a copied page may be hard to tell from the real one by sight alone.

How can you detect and reduce the risk?

MITRE says setting up a link target happens outside the view of the defended organization, so it cannot be easily stopped with preventive controls. It suggests focusing detection on later steps, such as when a victim receives or follows the link. Possible approaches include the following.

• Watch for inbound emails with embedded links that are followed by a user visiting a suspicious or obfuscated domain.
• Reason about the lure itself: MITRE says link targets can mask the true destination with URL obfuscation or link shorteners, so check where a link really leads before entering details.

Is a phishing kit the same as phishing?

No. Phishing is the scam itself. A phishing kit is a toolset that makes the scam easier to run. One kit can be used for many separate campaigns.

Is a phishing kit the same as phishing as a service?

Not exactly. A kit is a package of files and tools. Phishing as a service usually means the same idea offered as a paid service. The two ideas are close, so see the related terms.

Related pages in the Knowledge Hub

• Phishing
• Phishing and lookalike domains

Sources

• CISA: Section 3.2: ready-to-use phishing kits with pre-generated HTML pages and emails, scripts, email and proxy lists, hosting; bought and sold or free to download; lower….
• MITRE ATT&CK: Link Target: adversaries may clone legitimate sites and login pages, buy similar domains through typosquatting; cannot be easily mitigated with preventive controls;….