Exploring the cybercrime-as-a-service ecosystem: where and how phishing kits are marketed and sold online

• In Event: Cybercrime Offenders & Victims I

Abstract

This presentation aims to gain insight into the cybercrime-as-a-service ecosystem surrounding phishing kits and tools, particularly by identifying where and how these tools are being offered. As previous research has shown, the rise of CaaS markets has changed the way people engage in cybercrime. Initially, cybercrime was a highly skilled activity pursued by individuals motivated by curiosity and personal interest. As cybercrime became more profitable, skilled hackers began to sell their services, which now include many types of cybercrime including botnets, distributed denial of service attacks (DDoS), malware and phishing kits. This means that individuals motivated to carry out cyberattacks do not necessarily need to be technical masterminds, but simply find a suitable CaaS market. The phishing kits available on these platforms can be used to set up phishing websites and harvest user credentials by tricking victims into revealing personal or financial information. These kits are relatively inexpensive and easy to use, making the cost of conducting a cyber-attack affordable, especially when compared to the potential rewards. As a result, both individuals and criminal networks are increasingly using these platforms to acquire the technical tools necessary to carry out phishing attacks, thereby lowering the threshold to engage in phishing and shortening the path to cybercrime. By analyzing five online platforms, namely Google, YouTube, Telegram, GitHub and a hacking forum, as well as the sellers, buyers, and prices at which the various phishing services are offered, we can gain a better understanding of how potential cybercriminals can find phishing kits in CaaS markets. The study also examines the marketing tactics used by sellers to differentiate themselves from their competitors. This allows to identify differences between platforms in the way phishing kits are offered, and provides insight into how phishing kits are made available in the CaaS ecosystem.

Authors

• Tijmen Fuchs, The Hague University of Applied Sciences

• Rutger Leukfeldt, NSCR

• Asier Moneva, Netherlands Institute for the Study of Crime and Law Enforcement (NSCR); The Hague University of Applied Sciences

• Patricia Saldaña-Taboada, University of Granada