One More Trip to The W3LL: Phishing Kit Targets Outlook Credentials

Published on

Published on

Published on

Mar 19, 2024

Mar 19, 2024

Mar 19, 2024

One More Trip to The W3LL: Phishing Kit Targets Outlook Credentials
One More Trip to The W3LL: Phishing Kit Targets Outlook Credentials
One More Trip to The W3LL: Phishing Kit Targets Outlook Credentials
One More Trip to The W3LL: Phishing Kit Targets Outlook Credentials

One More Trip to The W3LL: Phishing Kit Targets Outlook Credentials

  • The W3LL Phishing Kit, a phishing-as-a-service (PAaS) tool, was identified by Group-IB in 2022. What makes the kit different from other services is a marketplace called W3LL Store, allowing users to choose the capabilities needed to complete their campaigns.

  • Primarily focused on Microsoft 365 credentials, W3LL utilizes adversary-in-the-middle (AitM) to hijack session cookies and bypass multi-factor authentication.

  • Hunt researchers discovered a phishing campaign underway that uses a fake Adobe Shared File service webpage to steal Outlook login credentials. The webpage tricks users into logging in to access supposedly shared files. Below, we'll briefly discuss our findings.

Open Directory

httpshuntioimagesblogsphishing-kitimg-1-4xwebp

Figure 1: Open Directory containing W3LL Phishing Kit Files

Hunt can identify exposed files on servers with open directory listings. Even if a server disappears from the internet, those files are available for download or preview on our platform. Warning: it's important to note that downloading such files should only be done in a safe environment.

Check it out: https://app.hunt.io/open-directory-crawler?host=https://192.3.137.252:443.

The presence of multiple folders named "OV6" in Figure 1 strongly indicates a W3LL phishing kit. W3LL typically places its control panel at "/OV6". These folders likely contain the core components of the phishing scheme, including obfuscated PHP files, which will be analyzed later.

Navigating to the HTML file within the /access folder leads to a phishing page imitating Adobe's Shared File service. The page lures the user to log in to retrieve a supposed file.

The spoofed Adobe shared file page uses the generic message "Your Contact has shared a file with you." This lack of personalization, compared to including the sender's name, might suggest the campaign is still under development. Phishing attempts often leverage personalization to appear more legitimate and increase the success rate.

httpshuntioimagesblogsphishing-kitimg-2-4xwebp

Figure 2: Screenshot of wfiles.html

When we tried logging in with fake credentials, the page sent a POST request to teffcopipe[.]com (5.63.8[.]243)/wazzy.php. This PHP file likely handles the stolen credentials on the attacker's end, potentially being the same script used by the W3LL phishing kit panel.

httpshuntioimagesblogsphishing-kitimg-3-4xwebp

Figure 3: Outlook login page & additional attacker infrastructure

The contents of OV6_ENCODED can be seen below. It's important to note that W3LL uses IonCube, a tool for encrypting/obfuscating PHP code, which is useful in slowing down research efforts.

httpshuntioimagesblogsphishing-kitimg-4-4xwebp

Figure 4: OV6_Encoded folder contents

As the name implies, config.php contains valuable details that provide insight into how the toolkit functions. A snippet is provided below.

httpshuntioimagesblogsphishing-kitimg-5-4xwebp

Figure 5: Snippet of config.php

Conclusion

We briefly shed light on a recent phishing campaign targeting Outlook credentials in this post. Cybercriminals impersonated the Adobe Shared File service to trick users into logging in and stealing their login information. Our analysis revealed additional infrastructure likely used for stealing credentials for sale or to send further phishing emails from a valid account.

Understanding how W3LL and similar kits operate is crucial to staying protected.

Here's what you can do:

  • Stay informed: Watch for future W3LL phishing campaigns targeting your organization.

  • Educate employees: Train your staff to identify suspicious emails and login pages. Look for generic messages, unexpected senders, and requests for login credentials on unfamiliar websites.

  • Consider Hunt: Explore security solutions like Hunt that can help identify open directories potentially exposing sensitive data and targeting organizations.

Ready to learn more? Apply for a Hunt account today and empower your team to stay ahead of cyber threats!

Network Indicators

Open Directory
192.3.137[.]252:443
Additional Infrastructure
teffcopipe[.]com → 5.63.8[.]243
/wazzy.php
Certificate: Let's Encrypt
Not Before: 2023-12-20 13:06:56
Not After: 2024-03-19 13:06:55
  • The W3LL Phishing Kit, a phishing-as-a-service (PAaS) tool, was identified by Group-IB in 2022. What makes the kit different from other services is a marketplace called W3LL Store, allowing users to choose the capabilities needed to complete their campaigns.

  • Primarily focused on Microsoft 365 credentials, W3LL utilizes adversary-in-the-middle (AitM) to hijack session cookies and bypass multi-factor authentication.

  • Hunt researchers discovered a phishing campaign underway that uses a fake Adobe Shared File service webpage to steal Outlook login credentials. The webpage tricks users into logging in to access supposedly shared files. Below, we'll briefly discuss our findings.

Open Directory

httpshuntioimagesblogsphishing-kitimg-1-4xwebp

Figure 1: Open Directory containing W3LL Phishing Kit Files

Hunt can identify exposed files on servers with open directory listings. Even if a server disappears from the internet, those files are available for download or preview on our platform. Warning: it's important to note that downloading such files should only be done in a safe environment.

Check it out: https://app.hunt.io/open-directory-crawler?host=https://192.3.137.252:443.

The presence of multiple folders named "OV6" in Figure 1 strongly indicates a W3LL phishing kit. W3LL typically places its control panel at "/OV6". These folders likely contain the core components of the phishing scheme, including obfuscated PHP files, which will be analyzed later.

Navigating to the HTML file within the /access folder leads to a phishing page imitating Adobe's Shared File service. The page lures the user to log in to retrieve a supposed file.

The spoofed Adobe shared file page uses the generic message "Your Contact has shared a file with you." This lack of personalization, compared to including the sender's name, might suggest the campaign is still under development. Phishing attempts often leverage personalization to appear more legitimate and increase the success rate.

httpshuntioimagesblogsphishing-kitimg-2-4xwebp

Figure 2: Screenshot of wfiles.html

When we tried logging in with fake credentials, the page sent a POST request to teffcopipe[.]com (5.63.8[.]243)/wazzy.php. This PHP file likely handles the stolen credentials on the attacker's end, potentially being the same script used by the W3LL phishing kit panel.

httpshuntioimagesblogsphishing-kitimg-3-4xwebp

Figure 3: Outlook login page & additional attacker infrastructure

The contents of OV6_ENCODED can be seen below. It's important to note that W3LL uses IonCube, a tool for encrypting/obfuscating PHP code, which is useful in slowing down research efforts.

httpshuntioimagesblogsphishing-kitimg-4-4xwebp

Figure 4: OV6_Encoded folder contents

As the name implies, config.php contains valuable details that provide insight into how the toolkit functions. A snippet is provided below.

httpshuntioimagesblogsphishing-kitimg-5-4xwebp

Figure 5: Snippet of config.php

Conclusion

We briefly shed light on a recent phishing campaign targeting Outlook credentials in this post. Cybercriminals impersonated the Adobe Shared File service to trick users into logging in and stealing their login information. Our analysis revealed additional infrastructure likely used for stealing credentials for sale or to send further phishing emails from a valid account.

Understanding how W3LL and similar kits operate is crucial to staying protected.

Here's what you can do:

  • Stay informed: Watch for future W3LL phishing campaigns targeting your organization.

  • Educate employees: Train your staff to identify suspicious emails and login pages. Look for generic messages, unexpected senders, and requests for login credentials on unfamiliar websites.

  • Consider Hunt: Explore security solutions like Hunt that can help identify open directories potentially exposing sensitive data and targeting organizations.

Ready to learn more? Apply for a Hunt account today and empower your team to stay ahead of cyber threats!

Network Indicators

Open Directory
192.3.137[.]252:443
Additional Infrastructure
teffcopipe[.]com → 5.63.8[.]243
/wazzy.php
Certificate: Let's Encrypt
Not Before: 2023-12-20 13:06:56
Not After: 2024-03-19 13:06:55

Related Posts:

Paste.ee Abuse Uncovered: XWorm & AsyncRAT Infrastructure
Jun 5, 2025

See how attackers abuse paste.ee to deliver XWorm and AsyncRAT, using obfuscated scripts and globally distributed C2 infrastructure.

Paste.ee Abuse Uncovered: XWorm & AsyncRAT Infrastructure
Jun 5, 2025

See how attackers abuse paste.ee to deliver XWorm and AsyncRAT, using obfuscated scripts and globally distributed C2 infrastructure.

Track Threat Actors Using Real-World IOC Pivoting
May 29, 2025

Track attacker infrastructure with Hunt.io’s real-time IOC pivoting and threat actor intelligence. Learn more.

Track Threat Actors Using Real-World IOC Pivoting
May 29, 2025

Track attacker infrastructure with Hunt.io’s real-time IOC pivoting and threat actor intelligence. Learn more.

Introducing Hunt 2.1:  Refinements to the Threat Hunting Experience
May 21, 2025

Discover the new Hunt.io updates: deep text assisted analysis, IOC feed improvements, improved threat actor data, and faster advanced search. Learn more.

Introducing Hunt 2.1:  Refinements to the Threat Hunting Experience
May 21, 2025

Discover the new Hunt.io updates: deep text assisted analysis, IOC feed improvements, improved threat actor data, and faster advanced search. Learn more.

Shared SSH Keys Expose Phishing Infrastructure Targeting Kuwait
May 15, 2025

Shared SSH keys expose coordinated phishing targeting Kuwaiti fisheries, telecoms, and insurers with cloned login portals and mobile payment lures. Learn more.

Shared SSH Keys Expose Phishing Infrastructure Targeting Kuwait
May 15, 2025

Shared SSH keys expose coordinated phishing targeting Kuwaiti fisheries, telecoms, and insurers with cloned login portals and mobile payment lures. Learn more.

Paste.ee Abuse Uncovered: XWorm & AsyncRAT Infrastructure
Jun 5, 2025

See how attackers abuse paste.ee to deliver XWorm and AsyncRAT, using obfuscated scripts and globally distributed C2 infrastructure.

Track Threat Actors Using Real-World IOC Pivoting
May 29, 2025

Track attacker infrastructure with Hunt.io’s real-time IOC pivoting and threat actor intelligence. Learn more.