There is no denying that phishing is on the rise. As we posted in a previous blog, the Anti-Phishing Work Group (APWG) observed that the number of unique phishing websites rose by a staggering 250% over the six months from October 2015 to March 2016.

So why has this occurred? Here at FraudWatch International we feel that one of the contributing factors is the ease at which people are able to create phishing sites. Gone are the days where only the most skilled hackers could develop a phishing site and scam users into divulging their personal information. Nowadays, any Joe Shmo, can create one and they do it with the help of a Phishing Kit.

Phishing kits are generally free kits provided by cyber-criminals to allow anyone with a little bit of IT knowledge to carry out a phishing attack. The authors of the kits are highly skilled and they ultimately drive a large portion of the phishing sites and brand abuse that we see. A phishing kit is a collection of tools which are assembled to make it easy for someone to launch a phishing exploit. Phishing kits are simply bundled versions (in zip format for example) that contain all the source code, images and scripts required to launch a phishing attack which looks identical to a legitimate login page but sends the stolen credentials directly to a criminal’s email inbox rather than the secure login server. The kits also include spamming software, to automate the mass-mailing process and allow the scammer to send out hundreds of thousands of phishing emails as bait for potential victims.

These phishing kits are often sold on the Dark Web or in underground hacking forums. Hackers also have a vast array of online tutorials available to them on popular streaming websites like YouTube. Because these phishing kits are so easy to find, people using the kits may not have the knowledge or technical skills needed to cover their tracks. Some amateur attackers stupidly use their own day-to-day email address on the phishing sites and use that same email to post onto online forums or boast about their successful campaigns on social networks.

There are a variety of tools online in this day and age that allow even amateur users to clone other websites and host their own versions, this means that phishing kits can be created even easier by the average criminal.

Once a phishing kit has been created, criminals will simply need to upload the .zip files to compromised sites to launch a new phishing attack. The ease of creating phishing sites combined with the number of exploitable websites out there on the internet leads to a rise in phishing as a whole.