Cyber-crooks bank on free phishing kits

Security experts have discovered free phishing kits on the internet which allow cyber-crooks to send fraudulent emails.

Panda Security's PandaLabs said that the tools allow cyber-crooks to spoof bank pages, online pay platforms, Gmail and Yahoo Mail accounts, online games and blogs.

"The really amazing thing is that these kits are free," said Luis Corrons, technical director of PandaLabs.

"The number of phishing attacks increases due to the simplicity of the tools, causing companies and consumers large losses. A recent Gartner study found that phishing attacks caused US consumer losses of $3.2bn in 2007."

After accessing a URL that contains the kits, the criminal can obtain two files to create a fraudulent mail.

One file allows them to spoof emails from banks and pay platforms, and the other allows them to create a fraudulent page that resembles the original. The kit also includes a free PHP program to send emails from the spoofed page.

The rest of the process is similar to other phishing attacks. The false email is sent to several mail addresses with a link to a malicious page at which users are requested to enter personal data such as email addresses and banking passwords.

"Cyber-crooks buy lists of addresses on the internet, although some are free, " said Corrons. "If we add free hosting services, the result is that cyber-crooks can launch phishing attacks at no cost whatsoever."

See also:

Phishers target Google AdWords users

Attack designed to steal sensitive data  06 May 2008

Third of UK surfers banking online

Brits seem unfazed by security concerns  29 Apr 2008

Infosec: Surfers wary of using credit cards online

Confidence plummets as attacks soar  24 Apr 2008

Infosec: Rock Phish threat deepens

Hugely successful malware gets a new twist  23 Apr 2008

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!