With the release of the PhaaS platform called ‘Caffeine’, threat actors can now easily launch their own sophisticated phishing attacks. Anyone who wants to start their own phishing campaign will be able to register on this platform through an open registration process.
Caffeine has been thoroughly tested by the analysts at Mandiant. This is a free and open-source platform that does not require any specific requirements like the following to use its portal for launching Phishing campaigns:-
- No invites or referrals required
- No approval needed
- No social shares required
- No specific joining or subscription to any social channel or hacking forum is needed
Consequently, many of the obstacles that one faces when using platforms of this kind are eliminated from this platform, Caffeine, and this makes this platform unique and lucrative from others.
Sophisticated Phishing Campaigns
Furthermore, what makes Caffeine stand out in the crowd is that it has templates that are aimed at Russian and Chinese platforms. This is unusual for this platform since the vast majority of platforms mainly promote lures that are targeted at Western services.
Due to its low entry barrier and its feature-rich nature, security analysts at Mandiant found that it is a problematic PhaaS with too many features.
As a result of an investigation into a large-scale phishing campaign, Mandiant discovered Caffeine. While this campaign was aimed at stealing Microsoft 365 account credentials from one of their users.
Plans
According to the report, Caffeine has a collection of tools that are designed to help you create phishing campaigns of all kinds. There is a different tariff system available on the Caffeine website and they all are based on the features that are provided.
While here below we have mentioned the price list:-
- For the “Basic” plan with 1-month validity will cost $250.
- For the “Professional” plan with 3-month validity will cost $450.
- For the “Enterprise” plan with 6-month validity will cost $850.
Rich features
Upon comparing the price chart to the average cost of a PhaaS subscription, it has been found that the price is about 3 to 5 times higher.
However, there are some services and advanced features that Caffeine has added to compensate for this shortcoming:-
- Customer support services
- Anti-discovery systems
- Mechanisms for setting up dynamic pages
- Anti-analysis systems
- Pages with pre-populated information about the victim
- Page redirection for the first stage and bait pages of the campaign
- Different types of IP address blacklist options
- Geoblocking options
- CIDR range-based blocking
Additionally, operators also get the option of using the email management utility tool of the platform that is based on Python or PHP. The use of external tools is thus reduced since this eliminates the need for them.
Caffeine could pose a big problem since novice cybercriminals can easily launch sophisticated phishing campaigns by utilizing this platform.
Get Your Copy of Free DDoS Protection Whitepaper to learn types of DDoS Attacks
