Saturday, April 13, 2024

Phishing-as-a-Service Platform Lets Anyone Launch Own Phishing Campaigns

With the release of the PhaaS platform called ‘Caffeine’, threat actors can now easily launch their own sophisticated phishing attacks. Anyone who wants to start their own phishing campaign will be able to register on this platform through an open registration process.

Caffeine has been thoroughly tested by the analysts at Mandiant. This is a free and open-source platform that does not require any specific requirements like the following to use its portal for launching Phishing campaigns:-

  • No invites or referrals required
  • No approval needed
  • No social shares required
  • No specific joining or subscription to any social channel or hacking forum is needed

Consequently, many of the obstacles that one faces when using platforms of this kind are eliminated from this platform, Caffeine, and this makes this platform unique and lucrative from others.

Sophisticated Phishing Campaigns

Furthermore, what makes Caffeine stand out in the crowd is that it has templates that are aimed at Russian and Chinese platforms. This is unusual for this platform since the vast majority of platforms mainly promote lures that are targeted at Western services.

Due to its low entry barrier and its feature-rich nature, security analysts at Mandiant found that it is a problematic PhaaS with too many features.

As a result of an investigation into a large-scale phishing campaign, Mandiant discovered Caffeine. While this campaign was aimed at stealing Microsoft 365 account credentials from one of their users.


According to the report, Caffeine has a collection of tools that are designed to help you create phishing campaigns of all kinds. There is a different tariff system available on the Caffeine website and they all are based on the features that are provided.

While here below we have mentioned the price list:-

  • For the “Basic” plan with 1-month validity will cost $250.
  • For the “Professional” plan with 3-month validity will cost $450.
  • For the “Enterprise” plan with 6-month validity will cost $850.

Rich features

Upon comparing the price chart to the average cost of a PhaaS subscription, it has been found that the price is about 3 to 5 times higher.

However, there are some services and advanced features that Caffeine has added to compensate for this shortcoming:-

  • Customer support services
  • Anti-discovery systems
  • Mechanisms for setting up dynamic pages
  • Anti-analysis systems
  • Pages with pre-populated information about the victim
  • Page redirection for the first stage and bait pages of the campaign
  • Different types of IP address blacklist options
  • Geoblocking options
  • CIDR range-based blocking

Additionally, operators also get the option of using the email management utility tool of the platform that is based on Python or PHP. The use of external tools is thus reduced since this eliminates the need for them.

Caffeine could pose a big problem since novice cybercriminals can easily launch sophisticated phishing campaigns by utilizing this platform.

Get Your Copy of Free DDoS Protection Whitepaper to learn types of DDoS Attacks


Latest articles

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...

Hackers Employ Deepfake Technology To Impersonate as LastPass CEO

A LastPass employee recently became the target of an attempted fraud involving sophisticated audio...

Sisence Data Breach, CISA Urges To Reset Login Credentials

In response to a recent data breach at Sisense, a provider of data analytics...

DuckDuckGo Launches Privacy Pro: 3-in-1 service With VPN

DuckDuckGo has launched Privacy Pro, a new subscription service that promises to enhance user...

Cyber Attack Surge by 28%:Education Sector at High Risk

In Q1 2024, Check Point Research (CPR) witnessed a notable increase in the average...

Midnight Blizzard’s Microsoft Corporate Email Hack Threatens Federal Agencies: CISA Warns

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive concerning a...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles