❌

Normal view

Before yesterdayMain stream

Security Operations – Sophos News
Phishing platform Rockstar 2FA trips, and “FlowerStorm” picks up the pieces 19 December 2024 at 09:11

Phishing platform Rockstar 2FA trips, and “FlowerStorm” picks up the pieces

Security Operations – Sophos News

By:gallagherseanm

19 December 2024 at 09:11

A sudden disruption of a major phishing-as-a-service provider leads to the rise of another…that looks very familiar

A screenshot of a Rockstar2FA "decoy" page, a fake auto dealer site.

Screen shots of the developer view of Chrome showing web requests sent from a Rockstar2FA phishing portal.

A pie chart showing the distribution of top-level domains the 10 most heavily used domain names were registered with. A third were .ru, a fifth were .com.

A bar chart showing the distribution of TLDs and number of URLs detected per month for Rockstar2FA. The number of .ru domains decreased significantly over time.

A screenshot of a failed connection error for a Rockstar decoy page.

A screenshot of an animated Office365 logo for Outlook used by Rockstar's phishing portal pages.

A screenshot of a Chrome developer view of a Rockstar pages.dev phishing portal failing to connect to a backend server.

A screenshot of data abouit and

Figure 9: the EnteraID log for a sign-in by the adversary-in-the-middle script on the phishing service’s back-end server.

Figure 10: the HTTP header data for a phishing page’s backend server communications on a separate host

Figure 11: A developer browser view of the phishing page protectivewearsupplies[.]doclawfederal[.]com/wQBPg/

Figure12: The document object model of a Rockstar2FA phishing page

Figure 13: The DOM of an older FlowerStorm phishing page (from June 2024)

Figure 14: The DOM of a newer FlowerStorm phishing page; the algorithm generating the title and function names uses a combination of two botanical-themed words

Figure 15: A chart plotting daily page detections for Rockstar2FA and FlowerStorm through the end of November 2024

Figure 16: The ten countries most targeted by attackers using FlowerStorm, based on Sophos detections

Figure 17: The ten business sectors most targeted by attackers using FlowerStorm

Threat Research – Sophos News
Phishing platform Rockstar 2FA trips, and “FlowerStorm” picks up the pieces 19 December 2024 at 09:11

Phishing platform Rockstar 2FA trips, and “FlowerStorm” picks up the pieces

Threat Research – Sophos News

By:gallagherseanm

19 December 2024 at 09:11

A sudden disruption of a major phishing-as-a-service provider leads to the rise of another…that looks very familiar

A screenshot of a Rockstar2FA "decoy" page, a fake auto dealer site.

Screen shots of the developer view of Chrome showing web requests sent from a Rockstar2FA phishing portal.

A pie chart showing the distribution of top-level domains the 10 most heavily used domain names were registered with. A third were .ru, a fifth were .com.

A bar chart showing the distribution of TLDs and number of URLs detected per month for Rockstar2FA. The number of .ru domains decreased significantly over time.

A screenshot of a failed connection error for a Rockstar decoy page.

A screenshot of an animated Office365 logo for Outlook used by Rockstar's phishing portal pages.

A screenshot of a Chrome developer view of a Rockstar pages.dev phishing portal failing to connect to a backend server.

A screenshot of data abouit and

Figure 9: the EnteraID log for a sign-in by the adversary-in-the-middle script on the phishing service’s back-end server.

Figure 10: the HTTP header data for a phishing page’s backend server communications on a separate host

Figure 11: A developer browser view of the phishing page protectivewearsupplies[.]doclawfederal[.]com/wQBPg/

Figure12: The document object model of a Rockstar2FA phishing page

Figure 13: The DOM of an older FlowerStorm phishing page (from June 2024)

Figure 14: The DOM of a newer FlowerStorm phishing page; the algorithm generating the title and function names uses a combination of two botanical-themed words

Figure 15: A chart plotting daily page detections for Rockstar2FA and FlowerStorm through the end of November 2024

Figure 16: The ten countries most targeted by attackers using FlowerStorm, based on Sophos detections

Figure 17: The ten business sectors most targeted by attackers using FlowerStorm