A new malicious platform, dubbed “Atlantis AIO,” provides a service for automated credential stuffing attacks against 140 online platforms, including email services, e-commerce websites, banks, and VPNs.
Atlantis AIO has pre-configured modules for these services, allowing for brute force attacks, CAPTCHA bypass, account recovery automation, and monetization of stolen credentials/accounts.
See also: Darcula phishing service will allow creation of DIY phishing kits
Atlantis AIO: Automated credential stuffing attacks
In credential stuffing attacks, hackers try combinations of usernames and passwords that they have stolen or found in lists leaked by other cybercriminals. The hackers hope that by using these credentials, they can gain access to accounts. If the credentials are correct and the account is not protected by multi-factor authentication, the hackers can compromise it, lock out the legitimate owner, or even resell the account to others.
Credential Stuffing as a Service
The Atlantis AIO platform is a new Credential Stuffing as a Service (CSaaS) platform that allows cybercriminals to pay a subscription fee and automate these attacks.
Atlantis AIO was discovered by Abnormal Security and can target over 140 online services worldwide. Targeted services include Hotmail, AOL, Mail.ru, Mail.com, Gmx, Wingstop, Buffalo Wild Wings, and Safeway, among others.
See also: Distributors of encrypted Sky ECC services arrested in Spain and the Netherlands
Atlantis AIO gives attackers the option to launch customized attacks. It includes three core modules:
Email Account Testing – Automates brute-force and takeover attempts on popular email platforms like Hotmail, Yahoo, and Mail.com. Attackers can gain control of the account and access the inbox.
Brute Force attacks – Uses common or weak passwords on targeted platforms to gain access to accounts that are not adequately protected.
Account Recovery – Exploits account recovery processes (e.g. on eBay, Yahoo), bypasses CAPTCHAs and automates account control acquisition, using tools like “Auto-Doxer Recovery” for faster and more efficient credential exploitation.
See also: Astaroth phishing kit bypasses 2FA
Defense against credential stuffing
- Use strong passwords ( which means they consist of letters, symbols, and numbers).
- Use different passwords for different servicesso that all accounts cannot be accessed if one password is leaked.
- Implement multi-factor authentication. This means that even if someone has your username and password, they'll need a second factor – usually a code sent to your phone – to gain access.
- Reject requests outside of company sites, block IP addresses with bad reputation, monitor and respond to suspicious connections.
- Regularly monitor accounts for any suspicious activity. If you notice anything unusual, change your password immediately and contact your service.
Source: www.bleepingcomputer.com
🔑 Secure your passwords with Proton Pass
Password manager from Proton — end-to-end encryption, passkeys, built-in 2FA, and monitoring for leaks of your credentials.
- ✔ Encrypted storage of passwords & passkeys
- ✔ Notification if any of your passwords are leaked (Dark Web Monitoring)
- ✔ Free version — on all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
