New FishXProxy Phishing Kit Making Phishing Accessible to Script Kiddies

A new phishing kit, FishXProxy, makes it alarmingly easy for cybercriminals to launch deceptive attacks. Learn how it works and how to protect yourself from these scams.

Phishing attacks have long been a menace, but a new toolkit called FishXProxy is making it disturbingly simple for even novice cybercriminals to launch sophisticated scams.

In their latest report, researchers at cloud messaging security platform, SlashNext Email Security, have disclosed exclusive details on FishXProxy, a new phishing kit discovered on the Dark Web.

FishXProxy is an end-to-end solution that lowers barriers for cybercriminals, offering advanced features like antibot configurations, Cloudflare Turnstile integration, built-in redirector, and page expiration settings.

The kit is advertised as “The Ultimate Powerful Phishing Toolkit,” as it can easily dismantle technical barriers associated with phishing campaigns, making launching attacks that bypass security defences and go undetected easier for cybercriminals.

FishXProxy is particularly dangerous because it makes phishing accessible to those with minimal technical skills. It is a comprehensive tool designed to create and manage phishing sites, aiming to evade detection and maximize the success rate of credential theft attempts. 

“FishXProxy equips cybercriminals with a formidable arsenal for multi-layered email phishing attacks…Even if one attack fails, cross-project tracking allows attackers to persistently target victims across multiple campaigns,” SlashNext’s researchers noted in their report.

Through this kit, phishing emails with unique links and dynamic attachments can bypass security checks. Advanced anti-bot systems weed out automated scans and potential victims. What is worse, FishXProxy also has built-in traffic management to hide the true destination of links and distribute traffic across multiple pages.

Additionally, short-lived scams can be set to expire after a set time, pressuring victims to act quickly. A cookie system allows attackers to identify and target users across campaigns, tailoring scams and building profiles of potential victims.

The toolkit can also create attachments using HTML smuggling to deliver malware while bypassing email filters making detection and mitigation challenging for traditional security measures..

FishXProxy is also equipped with a cross-project tracking capability that allows attackers to persistently target victims across multiple campaigns, adapting their strategies based on previous interactions. This persistence poses a significant challenge to traditional security measures, necessitating more sophisticated and proactive defences.

According to researchers, the kit’s deep integration with Cloudflare provides phishing operators with enterprise-grade infrastructure, making it much harder for detection and takedown efforts.

Mr. Mika Aalto, Co-Founder and CEO at Hoxhunt, a Helsinki-based Human Risk Management Platform commented on the latest development emphasizing that phishing kits are making it easier for even less skilled and resource-limited criminals to launch advanced phishing attacks.

“Phishing kits are lowering the barrier of entry to advanced cybercrime even for low-resourced and not clever criminals. As more phishing attacks consequently bypass filters, we need to make sure our people are equipped with the skills and tools to keep themselves and their colleagues safe,“ he said.

“Even advanced attacks will trigger a mental alarm in the upskilled human defence layer. With a dedicated threat reporting button integrated into the email client and connected directly to the SOC, we can quickly leverage a single threat report into the total extermination of a widespread phishing campaign that’s wormed its way into inboxes. Human threat intelligence can be a game changer when it’s factored into the security stack,“ Mika added.

To combat this threat, organizations need advanced security solutions that detect threats across various channels.  Employees should also be trained on the latest phishing tactics, and strong authentication measures should be implemented.