Rockstar 2FA: A Driving Force in Phishing-as-a-Service (PaaS)
Essential information
- Published
- 04/12/2024 23:12
- Modified
- 05/12/2024 10:25
- Tags
- 2024-12-03 2024-12-04 aitm dadsec email campaigns microsoft 365 phishing phishing-as-a-service rockstar rockstar 2fa
- Related entities
- 51 observables, 6 techniques (mitre)
Description
This analysis explores the Rockstar 2FA phishing-as-a-service kit, focusing on real-world email campaign examples. It highlights various techniques used by attackers, including the abuse of legitimate services for FUD (Fully Undetectable) links, such as Microsoft OneDrive, OneNote, Dynamics 365, Atlassian Confluence, and Google Docs Viewer. The use of QR codes in phishing attempts and the insertion of stolen email threads to inflate message size are also discussed. The article emphasizes the multi-stage nature of these attacks and the importance of caution when dealing with emails sent through trusted platforms.
External references
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/rockstar-2fa-a-driving-force-in-phishing-as-a-service-paas/
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/rockstar-2fa-phishing-as-a-service-paas-noteworthy-email-campaigns/
- https://otx.alienvault.com/pulse/6750e1e2ad0568f66faeff19