The NakedPages AiTM phishing toolkit is used to evade detection through a layered approach, leveraging legitimate SaaS services, Cloudflare Workers, and sophisticated redirections. The piece also argues that traditional MFA methods are often insufficient and that behavior-based detection can be more effective than purely technical checks. #NakedPages #AiTM
Keypoints
- Identity attacks, particularly AiTM phishing, are on the rise.
- The NakedPages phishing toolkit employs multiple techniques to evade detection, including the use of legitimate SaaS services and redirections.
- Cloudflare Workers serve as a reputable gateway for phishing attacks, helping attackers appear legitimate.
- Cloudflare Turnstile is used to differentiate between human users and bots, limiting automated analysis.
- Attackers require specific URL parameters and custom headers to access malicious content, complicating simple scans.
- JavaScript execution is necessary to reveal phishing pages, making static analysis less effective.
- Redirecting to legitimate domains and masking the HTTP referer help hide malicious activity and enable URL rotation with balanced domains.
- The kit adapts its behavior based on whether a personal or organizational account is used, showing targeted B2B tactics.
- Detection is more effective when focusing on user behavior (e.g., credential entry) rather than relying solely on technical indicators.
MITRE Techniques
- [T1566] Phishing – Brief description of how it was used. Quote relevant content using bracket (‘Tricking users into entering credentials on a fraudulent site.’)
- [T1003] Credential Dumping – Brief description of how it was used. Quote relevant content using bracket (‘Using phishing techniques to capture user credentials.’)
- [T1210] Exploitation of Remote Services – Brief description of how it was used. Quote relevant content using bracket (‘Exploiting legitimate services to host phishing content.’)
Indicators of Compromise
- [Domain] context – 226028cc.502f135e3e036e726fba22d4.workers.dev, acevoorgukmembership.buzz, and 2 more hashes
Read more: https://pushsecurity.com/blog/how-aitm-phishing-kits-evade-detection/