Dracula Phishing Platform Targets Organizations Worldwide – Source: securityboulevard.com

In light of recent cyber threats, the Dracula phishing platform has prevailed, targeting organizations in over 100 countries. The Dracula phishing attacks are centered on leveraging an immense network of over 20,000 counterfeit domains to scale the implementation of malicious intent. 

As per recent reports, the Dracula phishing campaign encompasses several high-profile attacks where both iOS and Android devices were used as part of the message phishing scam. In this article, we’ll dive into the details of Dracula phishing and uncover how it evades detection and what countermeasures can be adopted.

The Dracula Phishing Platform 

The Dracula phishing technique is one of the many modern-day advanced phishing techniques that have become a serious threat. The Dracula phishing platform allows threat actors to automate the steps needed to launch phishing attacks. Such capabilities make the platform suitable for less tech-savvy threat actors, as it makes exploitation efforts easier. 

The platform uses multiple programming languages, including JavaScript, React, Docker, and Harbor. It’s also capable of updating phishing sites with anti-detection protocols and new features without having to re-install phishing kits. It’s a Chinese phishing-as-a-service (PhaaS) platform that’s advertised on Telegram and has over 200 templates on offer.

Dracula Phishing Templates Bypassing SMS Filters

Phishing templates on the platform impersonate legitimate brands and can be availed of by threat actors for a monthly fee. Cybercriminals can then use these templates to carry out their malicious intent. As per recent reports, these templates have been designed to impersonate 

• Airlines.
• Private utilities.
• Postal services.
• Government bodies.
• Financial institutions. 
• Telecommunication organizations. 

Phishing sites on the platform use real brand names, further adding to their malicious legitimacy. Major platforms like Cloudflare, Tencent, Quadranet, and Multacom support these sites’ domains. According to recent reports, more than 20,000 domains across 11,000 IP addresses have been discovered. 

In addition, since the start of 2024, an average of 120 new domains have been identified on a daily basis. Dracula phishing leverages Apple’s iMessage and the Rich Communication Services (RCS) protocol pertaining to Google Messages, avoiding SMS use and, therefore, bypassing SMS filters. 

Commenting on these detection evasion tactics, Netcraft, a cybersecurity company, has stated that: 

“While end-to-end encryption in RCS and iMessage delivers valuable privacy for end users, it also allows criminals to evade filtering required by this legislation by making the content of messages impossible for network operators to examine, leaving Google and Apple’s on-device spam detection and third-party spam filter apps as the primary line of defense preventing these messages from reaching victims.”

Advanced Phishing Techniques In Dracula Attacks 

Threat actors using the Dracula phishing platform operate with the end goal of getting target users to visit a malicious site. On the site, they are scammed into handing over their personal and financial information. With iMessage, a safety measure that keeps links from being clickable unless received from an unknown sender is prevalent. 

However, Dracula phishing messages are able to bypass this protocol by giving users instructions to reply with a “Y” or “1.” When a user replies, the sender’s status automatically changes from unknown to known. After a reply, users are asked to reopen the conversation and follow the link.

These messages are sent from fake email addresses registered with Apple. Recent reports highlight that two of such email addresses include: 

• [email protected]  
• [email protected]

In one particular incident, threat actors posed as USPS personnel, “informing” the user about their package not being delivered due to an incomplete address. Another wave of Dracula phishing attacks is known to leverage shortcomings with Apple’s password reset protection protocols. 

During such attacks, users are sent multiple notifications asking them to reset their passwords. According to a cybersecurity journalist, if a user doesn’t fall for these messages or notifications, “the scammers will then call the victim while spoofing Apple support in the caller ID, saying the user’s account is under attack and that Apple support needs to ‘verify’ a one-time code.”

If threat actors succeed in sending a password reset code, they can change the password and lock users out of their Apple accounts. Gaining such control over a user’s account increases the opportunities for carrying out malicious intentions. 

Spotting A Phishing Message 

The Dracula phishing kits come with dire consequences as they enable less-skilled hackers to carry out full-fledged phishing campaigns. The domains that are used to host the phishing page are made to resemble real brand names. Given this, Netcraft has advised users to: 

“Look for inaccurate grammar, spelling errors, offers that are ‘too good to be true’ or require urgent action. If you’re expecting a message from an organization, navigate to their official website and avoid following links.”

In addition, users should also exercise extra care when deciding whether to open or follow a link sent to them from an unknown source. This helps them protect their information and keeps them from being scammed by threat actors using the Dracula phishing platform. 

Conclusion 

The Dracula phishing platform allows less tech-savvy threat actors to carry out their malicious intent. The platform provides them with multiple templates that can be used for phishing scams, as domains registered on the platform closely resemble real brand names. 

To ensure their safety, users are urged to look for spelling and grammar mistakes to spot malicious sites and must adopt ample care when deciding whether or not to follow links from an unknown source. 

In a world where cyber threats are rapidly evolving, using robust security measures has become essential for online security. Stay informed, stay secure! 

The sources for this piece include articles in The Hacker News and Help Net Security. 

The post Dracula Phishing Platform Targets Organizations Worldwide appeared first on TuxCare.

*** This is a Security Bloggers Network syndicated blog from TuxCare authored by Wajahat Raja. Read the original post at: https://tuxcare.com/blog/dracula-phishing-platform-targets-organizations-worldwide/