Tuesday, April 16, 2024

Researchers Uncover Phishing Empire Attacking 56,000+ Microsoft 365 Accounts

Recent reports indicate that a new threat actor named “W3LL” has been discovered running a large phishing empire completely hidden until now. It was also found that this threat actor played a major role in compromising Microsoft 365 business email accounts over the past few years. 

Furthermore, the threat actor was also running a hidden underground market with the name “W3LL Store” that served a phishing kit called “W3LL panel” and 16 other fully customized tools that can be used for Business Email Compromise (BEC) Attacks.

Evolution of W3LL

As per the reports shared with Cyber Security News, this cybercriminal actor has been active since 2017, when they built their first tool, W3LL SMTP Sender, which was used for bulk email spam. They further developed their version of the phishing kit for targeting corporate Microsoft 365 accounts and opened their own Marketplace W3LL Store in 2018.

W3LL stores have been reported to have more than 500 active users with more than 3800 items sold, and their revenue is estimated to be half a million dollars over the past 10 months.

Phishing Kit subscription – $500

W3LL Panel is their greatest tool that has one of the most advanced phishing kits in class, which also features adversary-in-the-middle functionality, API, source code protection, and other unique capabilities.

Many sophisticated threat actors currently use a three-month phishing kit subscription for $500 due to its high efficiency. Every copy of the W3LL Panel must be enabled via token-based authentication to prevent reselling and source code stealing.

More than 850 unique websites were found to be attributed to the W3LL Panel, and threat actors used this tool to initiate a Business Email Compromise Attack with over 56,000 corporate Microsoft 365 business accounts, and more than 8,000 (about 14.3%) of them ultimately compromised.

“W3LL regularly updates its tools, adding new functionalities, improving anti-detection mechanisms, and creating new ones, which underlines the importance of staying up-to-date with the most recent changes in their TTPs.” reads the post by Group-IB.

Group IB has published a complete report about this threat actor, providing detailed information about the tools being sold, indicators of compromise, Geography of operations, and much more.

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.


Latest articles

Hacker Customize LockBit 3.0 Ransomware to Attack Orgs Worldwide

Cybersecurity researchers at Kaspersky have uncovered evidence that cybercriminal groups are customizing the virulent...

Microsoft .NET, .NET Framework, & Visual Studio Vulnerable To RCE Attacks

A new remote code execution vulnerability has been identified to be affecting multiple Microsoft...

LightSpy Hackers Indian Apple Device Users to Steal Sensitive Data

The revival of the LightSpy malware campaign has been observed, focusing on Indian Apple...

LightSpy Malware Attacking Android and iOS Users

A new malware known as LightSpy has been targeting Android and iOS users.This sophisticated...

This Startup Aims To Simplify End-to-End Cybersecurity, So Anyone Can Do It

The Web3 movement is going from strength to strength with every day that passes....

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles