A joint operation by Interpol and cybersecurity firms led to the capture and shutdown of the notorious 16shop phishing-as-a-service (PhaaS) platform.
See also: Robin Banks: New phishing service targets customers of major banks
Phishing-as-a-service platforms offer cybercriminals a one-stop-shop for conducting phishing attacks. These platforms typically include everything they need, such as email distribution, ready-made phishing kits for well-known brands, hosting, data proxies, victim overview dashboards, and other tools that help increase the success of their operations.
These platforms pose a significant risk as they lower the bar of entry for inexperienced cybercriminals, offering them a simple and cost-effective way to launch phishing attacks with just a few clicks.
Group-IB, which assisted Interpol in the seizure operation, reports that the 16shop platform offered phishing packages that targeted, among others, Apple, PayPal, American Express, Amazon and Cash App accounts.
Group-IB telemetry data shows that 16shop is responsible for creating 150,000 phishing pages, which targeted individuals primarily from Germany, Japan, France, the US, and the UK.
Interpol's announcement states that at least 70,000 users from 43 countries were exposed to phishing pages created through 16shop.
The data stolen in these attacks includes personal information, account emails and passwords, IDs, credit card numbers, and phone numbers.
Suggestion: Phishing emails from Amazon are what hackers are choosing these days!
Arrest of the operator
The Interpol operation resulted in the arrest of the 21-year-old platform operator in February 2022 in Indonesia and later led to the arrest of two intermediaries, one in Japan and one in Indonesia.
“A notorious “phishing-as-a-service” (PhaaS) platform, known as “16shop”, has been shut down as part of a global investigation coordinated by INTERPOL, with Indonesian authorities arresting its operator and one of its intermediaries, while another was arrested in Japan,” Interpol’s press release states
“With the help of information from a number of private sector partners, the INTERPOL team was soon able to determine the identity and possible location of the platform operator,” Interpol.
A US-based company hosted 16shop's servers, but its registration information indicated it was based in Indonesia.
Police in Indonesia arrested the young man and confiscated electronic items and various luxury vehicles in the operator's possession.
The two intermediaries were identified and subsequently arrested after the manager was arrested, suggesting that he may have disclosed information about his accomplices.
Read also: New PhaaS “Greatness” simplifies Microsoft 365 phishing attacks
source of information:bleepingcomputer.com
