Investigating Infrastructure and Tactics of Phishing-as-a-Service Platform Sniper Dz
Essential information
- Published
- 25/09/2024 08:55
- Modified
- 25/09/2024 09:39
- Tags
- 2024-09-25 credential-theft phaas phishing sniper dz victim tracking
- Related entities
- 7 observables, 1 intrusion sets (apt), 10 techniques (mitre), 1 malware
Description
Unit42 explores Sniper Dz, a popular phishing-as-a-service (PhaaS) platform targeting social media and online services. Over 140,000 phishing websites associated with Sniper Dz were identified in the past year. The platform offers an admin panel with phishing page catalogs, allowing users to host on Sniper Dz infrastructure or download templates. Surprisingly, services are free, likely because Sniper Dz collects stolen credentials. The platform uses public proxy servers to hide phishing content, obfuscates code, and employs centralized infrastructure for credential exfiltration and victim tracking. Sniper Dz abuses legitimate SaaS platforms, particularly Blogspot, and uses brand names or trends as keywords in hostnames. After credential theft, victims may be redirected to malicious advertisements or potentially unwanted applications.