100+ Organizations Affected by EvilProxy Phishing

Proofpoint Inc. has released a report highlighting the surge in the popularity of EvilProxy, particularly in its use for targeting Microsoft 365 accounts of top-level executives within prominent companies. Cybercriminals favor these kits due to their minimal requirement for technical expertise or programming skills, all while delivering effective outcomes.

This campaign has dispatched around 120,000 phishing emails to numerous organizations across the globe from March to June 2023. Of the several users who fell victim, almost 39% were identified as high-ranking executives, encompassing CEOs (9%) and CFOs (17%). The attacks have specifically targeted individuals with access to financial resources or confidential data.

Proofpoint experts reported that threat actors exploited "EvilProxy" to capture credentials safeguarded by multi-factor authentication (MFA) and session cookies. Over the past six months, these experts noticed a doubling in cloud account breaches impacting high-level executives at large companies using EvilProxy.

"Employee credentials are prized by threat actors — they can offer access to valuable or sensitive corporate information and user accounts," the Proofpoint team mentioned. "While stolen credentials offer a multitude of attack vectors for cybercriminals, not all credentials are created equal."

According to SC Media, these emails impersonate brands, utilizing third-party service offerings to deceive users into clicking on links infused with malware. When the phishing server mimics the genuine login form, it has the capability to capture authentication cookies as soon as a user accesses their account. Moreover, since the user has already cleared MFA challenges during login, the purloined cookie grants threat actors the ability to circumvent multi-factor authentication.

In September 2022, Resecurity highlighted that EvilProxy is available for purchase by cybercriminals at $400/month, touting the capability to target accounts on platforms such as Apple, Google, Facebook, Microsoft, Twitter, GitHub, GoDaddy, and PyPI.