Log in Request a demo

Security News

Frappo: A New “Phishing-as-a-Service” On The Dark Web

Frappo is a phishing-as-a-service tool seen on the dark web. It sells fake pages that copy banks and shops. Learn how it works and how to stay safe.

Brandefense logo Updated 3 Min Read
frappo is the phishing service on the dark web

Frappo is a phishing-as-a-service tool found on the dark web, where criminals pay to host and build phishing pages that copy banks, online shops and popular services. It was first seen around 22 March 2021 and covers more than 20 financial institutions, retailers and services. It runs as a browser extension for Chrome or Firefox and guides the buyer through a setup wizard.

What is Frappo?

A new underground service called “Frappo” has been seen on the dark web. Frappo provides threat actors with the ability to host and create high-quality phishing pages that imitate online banking, e-commerce, popular retailers, and online services to capture customer data.

Frappo is a service that serves as a Phishing (PaaS) provider as a Service. The service, first known to emerge on the dark web around 22 March 2021, has been significantly improved, providing phishing pages for more than 20 financial institutions, online retailers, and popular services such as Netflix and Uber. In terms of appearance, Frappo is designed as a service that gives the impression of an anonymous crypto wallet. The original project with a similar name is currently available on GitHub, allowing developers to integrate payment methods that support Ethereum and Bitcoin.

How does Frappo work?

It was observed that Frappo, technically a browser extension, was added to Chrome’s online store by threat actors. Enabling the extension requires installing the browser plug-in on Firefox or Google Chrome and making payments.

Frappo developers offer a variety of payment plans for threat actors based on the subscription period they choose. When Frappo is activated, the threat actors are provided with a navigation menu to create a new phishing page (phishlet). An interactive wizard is then provided that allows threat actors to configure settings, define server credentials, and select the brand to imitate.

Phishing pages categorized by brand and profiles are of high quality and contain interactive scenarios that fool targets into entering critical credentials. Threat actors successfully use PaaS platforms such as Frappo for malicious activities such as Account Import (ATO), Commercial Email reconciliation (BEC), Payment, and Identity Theft.

How a Frappo phishing page is set up
  1. Install the extensionAdd the plug-in to Chrome or Firefox and pay for a plan.
  2. Create a phishletUse the menu to start a new phishing page.
  3. Configure the pageSet server credentials and pick the brand to imitate.
  4. Targets are luredPages ask victims to enter critical credentials.Technique T1566 (MITRE ATT&CK, opens in a new tab)

How can you protect yourself from phishing services like Frappo?

Threat actors use advanced tools and tactics to target global consumers, so protecting digital identity becomes one of the most critical priorities for online security. In this context, it is recommended that;

  • users and organizers who are members of e-commerce platforms ensure the reliability of the platforms where they use critical account information,
  • do not rely on email, attachments, and links from unknown parties,
  • not keep the input information available in the account in the browser memory,
  • enable the 2FA/MFA features on any platform available, and
  • use comprehensive security solutions.

Frequently Asked Questions.

What is Frappo?

Frappo is a phishing-as-a-service tool found on the dark web. It lets criminals host and build phishing pages that imitate banks, online shops and popular services.

How does Frappo work?

It is a browser extension for Chrome or Firefox that the buyer installs and pays for. A wizard then lets them create a phishing page, set server credentials and choose the brand to imitate.

What is phishing?

Phishing uses email or malicious websites to ask for personal information while posing as a trustworthy organization. MITRE ATT&CK describes it as electronically delivered social engineering.

How can I protect myself from phishing pages like these?

Do not click links or open attachments from unknown senders, and check requests directly with the organization. Turn on multifactor authentication wherever it is offered.

Sources

  1. 1 MITRE ATT&CK: Phishing (T1566)
  2. 2 CISA: Avoiding Social Engineering and Phishing Attacks

Try it on your own domain

Type a domain to see the kinds of imitations an attacker would consider.

Generated in your browser, nothing is sent.

    Check a domain with the free scanner

    Share

    In This Article

    TechniquesPhishing (T1566): ATT&CK Technique TermsPhishing-as-a-service (PhaaS) TermsThreat actor

    Where To Next.

    All Security News Articles
    In plain words · Glossary term Phishing-as-a-service (PhaaS)

    Phishing-as-a-service (PhaaS) is a model where cyber threat actors provide access to phishing kits to others in exchange for a one-time fee or subscription.

    Open →     Keep reading · Article Bitter APT Targets Bangladesh’s Key Institutions Through Phishing Emails

    Bitter APT used phishing emails with malicious documents to target Bangladesh's key institutions.

    Open →     Keep reading · Article Multiple Privilege Escalation Vulnerabilities Detected in Linux Operating System

    The vulnerabilities collectively called "Nimbuspwn" can be used to gain root privileges on Linux systems and allow threat actors to deploy various malware.

    Open →

    Knowledge HubKnowledge Hub