W3LL Phishing Campaign Impersonates Adobe to Steal Outlook Credentials
Summary
Researchers found a W3LL phishing campaign using a fake Adobe Shared File page to steal Outlook credentials. The kit uses adversary-in-the-middle techniques to capture session cookies and bypass MFA.
Key points
- The campaign lured users to a fake Adobe Shared File page to obtain Outlook login credentials.
- Researchers identified W3LL kit indicators, including multiple “OV6” directories and obfuscated PHP files.
- A test login sent a POST request to teffcopipe[.]com (5.63.8[.]243)/wazzy.php, which likely handled stolen credentials.
- W3LL can use adversary-in-the-middle techniques to hijack session cookies and bypass multi-factor authentication.
- The researchers advise watching for generic messages, unexpected senders, and unfamiliar pages requesting credentials.
Article Details
- Attack Vectors
- A fake Adobe Shared File webpage lured users to enter Outlook credentials to access a supposedly shared file.
- The page sent submitted credentials in a POST request to teffcopipe[.]com at /wazzy.php.
- The article states that W3LL uses adversary-in-the-middle techniques to hijack session cookies and bypass multi-factor authentication.
- Defensive Notes
- Train employees to recognize suspicious emails, generic messages, unexpected senders, and login requests on unfamiliar websites.
- Monitor for W3LL phishing campaigns targeting the organization.
- Identify exposed files on servers with open directory listings; analyze downloaded files only in a safe environment.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | teffcopipe[.]com | Credential-submission endpoint used by the phishing page. |
| IPV4 | 192[.]3[.]137[.]252 | Open-directory server containing files strongly indicative of a W3LL phishing kit. |
| IPV4 | 5[.]63[.]8[.]243 | IP address associated in the article with the credential-submission endpoint. |
MITRE ATT&CK
Products
Adobe Shared File serviceHunt researchers discovered a phishing campaign underway that uses a fake Adobe Shared File service webpage to steal Outlook login credentials.Microsoft 365 Apps for EnterprisePrimarily focused on Microsoft 365 credentials, W3LL utilizes adversary-in-the-middle (AitM) to hijack session cookies and bypass multi-factor authentication.OutlookHunt researchers discovered a phishing campaign underway that uses a fake Adobe Shared File service webpage to steal Outlook login credentials.
Tools
IonCubeinfrastructureThe contents of OV6_ENCODED can be seen below. It's important to note that W3LL uses IonCube, a tool for encrypting/obfuscating PHP code, which is useful in slowing down research efforts.W3LL Phishing KitThe W3LL Phishing Kit, a phishing-as-a-service (PAaS) tool, was identified by Group-IB in 2022.