W3LL Phishing Kit Launches Active Campaign to Steal Outlook Login Credentials

Cybersecurity researchers have recently uncovered a sophisticated phishing campaign leveraging the notorious W3LL Phishing Kit.

Originally identified by Group-IB in 2022, W3LL differentiates itself in the criminal ecosystem as a phishing-as-a-service (PaaS) tool, supported by a unique marketplace known as the W3LL Store.

This marketplace allows threat actors to selectively purchase functionalities and components needed to conduct tailored phishing campaigns, making it more accessible and adaptable than conventional off-the-shelf kits.

Advanced Phishing-as-a-Service Campaign

The campaign’s primary objective centers on harvesting Microsoft 365–specifically Outlook–login credentials through advanced adversary-in-the-middle (AitM) techniques.

These tactics enable cybercriminals to intercept and hijack session cookies, which effectively bypasses multi-factor authentication protections.

By gaining access to valid session tokens, attackers can infiltrate corporate environments and maintain persistence, even in scenarios where strong authentication mechanisms are in place.

The Hunt research team identified an active phishing campaign deploying a deceptive webpage impersonating Adobe’s Shared File service.

Victims, lured by claims of a shared file, are prompted to submit their Outlook credentials to retrieve the supposedly important document.

The cloned Adobe login page, while still lacking in personalization such as the sender’s name (a feature more common in mature, targeted campaigns), nonetheless employs proven social engineering techniques to exploit users’ trust in well-known brands and services.

Technical Analysis

An open directory on a server attributed to the campaign revealed multiple folders entitled “OV6,” which serves as a strong indicator of W3LL kit deployment.

According to analysts, the W3LL phishing kit typically utilizes an “/OV6” path for its control panels.

Within these directories, the core phishing infrastructure is stored, including heavily obfuscated PHP files that manage credential harvesting and backend operations.

The kit relies on tools like IonCube for PHP code encryption and obfuscation, complicating reverse engineering efforts and hampering analysis by security professionals.

Upon examination, researchers discovered that entering any credentials into the fake login prompt resulted in a POST request directed to a remote PHP script specifically, wazzy.php hosted on teffcopipe[.]com.

This script is likely responsible for processing and storing stolen account details, and potentially facilitating further actions such as credential resale or enabling follow-up phishing attacks from compromised accounts.

Additional scrutiny of the kit’s “OV6_ENCODED” directory and associated configuration files, such as “config.php,” confirmed the modular and scalable nature of the platform.

The configuration contains parameters governing the kit’s operation, target selection, and the exfiltration of harvested credentials.

The campaign’s infrastructure also utilizes a valid Let’s Encrypt certificate, which may lend perceived legitimacy to victims and bypass simplistic browser-based security warnings.

The W3LL phishing kit represents a significant escalation in phishing as a service, offering cybercriminals not only effective attack tools but also a tailored service model.

Its ability to circumvent MFA and automate large-scale credential theft poses a severe threat to enterprises, particularly those reliant on Microsoft’s ecosystem for email and productivity.

Defenders are urged to stay up-to-date on emerging campaigns and invest in employee training focused on phishing awareness.

Employees should be taught to identify emails and landing pages that use generic messaging or unfamiliar domains.

Security professionals can benefit from tools like Hunt’s open directory crawler to proactively identify exposed directories that could be leveraged or targeted by phishing kits.

As phishing kits like W3LL continue to evolve, understanding their technical underpinnings is essential for devising effective detection and mitigation strategies.

In this case, proactive monitoring for indicators of compromise (IoCs) and rapid response protocols remain the best defense against credential harvesting attacks.

Indicators of Compromise (IoCs)

Type	Indicator	Notes
Open Directory	192.3.137[.]252:443	Likely hosts kit components
C2 Infrastructure	teffcopipe[.]com	Receives POST credential data
C2 IP	5.63.8[.]243	Associated with phish backend
Malicious Script	/wazzy.php	Credential collection endpoint
Certificate	Let’s Encrypt	Valid: 2023-12-20 to 2024-03-19

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!