As “newbie blackhat hacker wannabes”, we opted to start with something simple. We chose to use a free web shell sample of a randomly compromised WordPress website found in one of the groups. To maintain persistence, we replaced the current web shell with our own password-protected PHP file. It was striking to see how effortlessly and without cost we could proceed with our scheme. We went live with the scampage almost instantly, utilizing a reputable domain.

Distributing our freshly crafted scampage link effectively is about targeting the right audience and in masses. An email can be a powerful tool for reaching a broad demographic and telling the right “story”. However, there are significant limitations and challenges. For instance, personal Gmail accounts have a cap of around 500 on the number of emails they can send per day, and emails from new accounts often end up in spam folders, diminishing the impact of the campaign.

Despite these challenges, the Telegram market offers an array of tools and methods to overcome these hurdles.

Hacked SMTP Credentials — Using someone else’s SMTP server credentials is an effective way to obtain a higher sending quota and leverage a reputable source. These credentials, which are often hacked, leaked, or acquired through brute force, are available for purchase. This approach, however, carries significant risks. The credentials are generally good for one-time use, as they tend to get blocked quickly once abuse is discovered. It’s a gamble — as the sellers often warn — “high risk, high reward”.

Backdoor Mailers — Similar to a web shell upload interface we saw earlier, this script is injected into compromised websites and gives you a user-friendly interface, referred to as “Mailer” in the Telegram lingo.
As this Mailer is hosted on compromised websites, it enables us to craft emails using a legitimate domain of the exploited website. For example, if a backdoor mailer is installed on a site like www.youritsolutions.it/hacked_mail_interface.php, it enables sending convincing, reputable tech scam emails from an address such as [email protected]. These emails are more likely to bypass spam filters and reach their targets, seeming credible due to their origin.

Probably the most common mailer is the “Leaf PHPMailer”, based on an open-source PHP library. It’s a user-friendly interface that even includes a built-in DNS spam check feature for the hosted compromised domain. This function is critical for assessing the mailer’s effectiveness and determining whether it has already been flagged as a spamming source.

Mass Mailer Services — Using a legitimate account from a well-known mass mailing service like SendGrid or Amazon SES can be a more reliable method than relying on hacked credentials or backdoor mailers. These platforms are already used for marketing and other large-scale email purposes.
As a scammer\hacker, Directly signing up for these services can be complex due to rigorous customer verification processes, including credit card validation and other authorization steps. That’s why scammers often purchase accounts from Telegram sellers:

These sellers sometimes “warm up” the accounts by sending legitimate emails for a while, boosting the account’s reputation. Each SMTP account from these services has a daily sending limit, which can range anywhere from 20,000 to 500,000(!) emails. The price of these accounts typically varies according to their email-sending limit.

Indeed, the methods mentioned earlier can be expensive, especially for those just starting in this field. That’s where the PHP mailer method comes into play, offering a range of free samples. With some experimentation, we managed to find fresh samples that hadn’t been used before, were not blacklisted by any DNS provider, and were fully functional. However, their effective lifespan is short, so it’s crucial to act quickly and utilize the full quota — which is around 25,000 emails per sample. That’s a substantial number for a free option.

With 3–4 functioning mailers at our disposal, we can dispatch nearly 100,000 emails.

Now the missing part is: what should these emails say? What will ensure that they bypass spam filters, entice clicks, and ultimately lead to the submission of bank credentials?

In today’s landscape, we could leverage tools like ChatGPT to compose professional-looking messages. However, crafting an email that convincingly mimics legitimate bank communication requires more than just persuasive text. The styling and branding are vital: HTML, images, CSS, and ensuring compatibility across devices. The goal is to make the message appear as authentic as possible, indistinguishable from genuine bank correspondence. This is what scammers often refer to as “Letters” — expertly designed, branded templates that are virtually indistinguishable from the real thing.

These “Letters” also incorporate techniques to evade spam detection, such as randomizing content between messages, inserting invisible characters, and using images instead of scannable text. Many also include embedded analytics tools to track if the email has been read and to pinpoint the location of the recipient. This allows for a more strategic management of the “marketing” campaign.

Fortunately, our purchased scampage of Bank of America already came bundled with a “Letter“:

To ensure its success, as it was probably used in the past already, one can edit it a bit, change the text, and reformat it to make it unique. And so, we are ready with everything needed to send those emails. Well, almost…

With our setup ready, time is of the essence to dispatch those emails before the fragile mailers are detected and blocked. We just need to know whom we are going to send them to. It’s time to acquire a substantial list of relevant and active email addresses — ideally, at least 100,000.

These lists, known as “leads” in scammer lingo, are a bulk of contact information of potential targets. They typically include email addresses and phone numbers, and sometimes they’re enriched with additional personal information like names, physical addresses, and other data that might have been leaked or stolen. These leads can be incredibly specific, tailored for any region, niche, demographic, specific company customers, and more.

“Your Personal Details Have Been Leaked!”
Does this alarming message sound familiar? This is precisely what happens to your details after they are leaked. Your private details become ‘leads’ — that hackers exploit for further malicious activities!

Every piece of personal information adds to the effectiveness and credibility of these attacks. This underscores the importance of having a comprehensive understanding of one’s leaked data. At Guardio, we address this through our “Leaks” feature, which involves deep scanning of the dark web for any bit of personal information compromised and promptly informing our users, ensuring real-time awareness and protection.

Some sellers even specialize in providing leads for individuals who are likely to be more vulnerable or lucrative targets for scams — such as those with higher incomes, homeowners, business owners, the elderly, and other demographics deemed more susceptible to fraud. These targeted leads increase the chances of a successful scam.

The origins of these lead lists can vary significantly among sellers. Some acquire them by sifting through data leaks from major companies, which occasionally are available for free. For instance, a data breach at a bank can easily yield a list of its account holders. The more detailed the information in the data leak, the easier it is to compile a comprehensive and precise list.

Other sellers, particularly those offering more high-end services, gather their lists through survey scams. These are deceptive websites that lure users with the promise of rewards for answering questions, only to harvest and sell their private data.

Ever seen one of these? You didn’t really win an iPad — you just gave away your info to scammers for their next targeted campaign.

For the final piece of our phishing scheme, securing a precise and relevant leads list is critical. Following some negotiation, we acquired a list of 100,000 Bank of America customers. This list is particularly valuable due to its relevance and targeting, hence it comes at a significant cost. We spend an additional $200, bringing our total expenditure to $230. Now, we are just a click away from launching our campaign!

“Congratulations”! Our (definitely not real) first phishing campaign is up and running!

Our efforts soon start to bear fruit. Victims fall for the trap, clicking on the link and some even proceed to log into the fraudulent bank site — our scampage. Once they do this, their bank accounts become compromised.

The balance in these accounts varies; some hold minimal funds, while others have substantial balances. Extracting cash from these accounts is a whole different level of criminality, and significantly more complex. This is where the scammer’s supply chain comes into play.

As smaller-scale scammers, who only need a computer, some free time, and an internet connection to execute their schemes and gather a multitude of stolen credentials, are effectively fueling the supply chain for the bigger players. These more sophisticated and organized criminal groups purchase these credentials (a.k.a “Logs” in underworld lingo) to further their illicit operations.

Social media account credentials are sold for as little as a dollar, while banking accounts and credit cards could be sold for hundreds of dollars — depending on their validity and funds.

Now, let’s play the numbers game and assume the worst-case financial scenario to illustrate the minimal financial gain these types of scam activities might yield.
After sending 100k emails to relevant BOA customers, let’s say we get only 50 valid bank account details. These accounts can now be exploited or sold up the supply chain to other criminal entities or scammers.
Let’s say five of those have a decent 10k+ USD balance we can sell at around 200$ each, and the rest for around 30$. Assuming the following funnel we can make a 10x return on our investment. Not bad!

These markets have transformed significantly from the hidden, invite-only forums of the DarkNet. Now, they are public channels on mainstream platforms, teeming with thousands of users and daily activity. Sellers build reputations and offer “free samples,” “customer support,” “trial versions,” and even “money-back guarantees” — terms previously associated with legitimate businesses, signifying the emergence of a real industry with substantial financial stakes.

Unfortunately, with just a small investment, anyone can start a significant phishing operation, regardless of prior knowledge or connections in the criminal underworld. Those campaigns even leverage advanced detection and MFA mitigations that easily circumvent protections we blindly rely on.

While we’ve covered a range of services, this is merely scratching the surface. There’s a plethora of other operations like SMS, carding, money laundering, advertising services, unethical SEO solutions, and much more.

Note how tools for phishing campaigns are often sourced through compromising legitimate websites, services, and accounts. A prime example is vulnerabilities in WordPress sites belonging to organizations, small businesses, or educational institutions, not adequately protected against known security threats.

This situation highlights a dual responsibility for site owners. They must safeguard not only their business interests but also protect against their platforms being used by scammers for hosting phishing operations, sending deceptive emails, and conducting other illicit activities, all unbeknownst to them.

At Guardio, our Labs research team is deeply embedded in monitoring the underground cyber world, keeping a watchful eye on emerging threats. Our mission is dual-purpose: firstly, to increase awareness about these malicious activities and secondly, to enforce the Guardio protection suite and the rest of the cyber security ecosystem with strong strategies and techniques to counter them effectively.