Cybersecurity researchers have uncovered an ongoing phishing campaign leveraging the infamous W3LL Phishing Kit, which has been at the forefront of credential theft operations since its identification by Group-IB in 2022.
What distinguishes W3LL from conventional phishing-as-a-service (PaaS) tools is its integrated marketplace, the W3LL Store, where threat actors can tailor their toolkit by purchasing modular capabilities for various stages of their phishing campaigns.
Multi-Factor Authentication Bypassed
W3LL’s primary target remains Microsoft 365 credentials, employing an advanced adversary-in-the-middle (AiTM) attack technique to intercept session cookies and effectively circumvent multi-factor authentication.
Recently, Hunt.io researchers identified a campaign exploiting a fraudulent Adobe Shared File service page to lure potential victims into divulging their Outlook login credentials.
This phishing scheme directs users to seemingly legitimate file-sharing notifications, prompting them to authenticate in order to access a fictitious document.
Upon analysis, researchers found an open directory on a server containing multiple folders labeled “OV6,” which is recognized as the standardized location W3LL uses for its control panel.
These directories housed the core components of the phishing toolkit, including obfuscated PHP scripts protected with IonCube encoding an additional layer designed to hinder forensic investigation and slow down reverse engineering efforts.
Imitation Login Pages
Victims landing on the spoofed Adobe file-sharing page are shown a generic message: “Your Contact has shared a file with you.”
Notably, the absence of sender personalization could indicate the campaign’s ongoing development, as customization typically increases attack credibility.
When test credentials were submitted, traffic analysis revealed that the data was transmitted via a POST request to a remote PHP script hosted on the attacker’s server (teffcopipe[.]com), which is suspected to be directly linked to the W3LL kit’s credential handling backend.
Further inspection of the server’s directory structure revealed encrypted configuration files (notably config.php), which are crucial to the operation of the phishing kit.
Such files often contain parameters related to exfiltration endpoints, campaign management, and victim tracking.
The persistence and sophistication of the W3LL phishing kit underscore the need for heightened vigilance among organizations, particularly those utilizing Microsoft 365 services.
Defenders are urged to keep abreast of evolving phishing tactics, educate employees about scrutinizing login prompts especially those following generic notifications or originating from unfamiliar sources and to deploy proactive monitoring solutions to detect exposed directories and malicious infrastructure.
Security solutions such as Hunt.io can aid in identifying open directories on public servers, potentially mitigating the risk before attackers can leverage these resources for widespread campaigns.
With W3LL’s modular and marketplace-driven model proving attractive to cybercriminals, ongoing vigilance and layered security remain paramount.
Indicators of Compromise (IOC)
| Indicator Type | Value | Notes |
|---|---|---|
| Open Directory | 192.3.137[.]252:443 | W3LL kit files exposed |
| Phishing Endpoint | teffcopipe[.]com → 5.63.8[.]243 | Receives stolen credentials |
| PHP Credential Script | /wazzy.php | Handles credential exfiltration |
| SSL Certificate | Let’s Encrypt (2023-12-20 to 2024-03-19) | Used by attack infrastructure |
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates
