Ankura CTIX FLASH Update - July 15, 2022

Ransomware Activity

New PayPal Phishing Kit Discovered Hijacking Previously Compromised WordPress Websites

Akamai researchers discovered a new phishing kit targeting PayPal users with the goal of exfiltrating large amounts of personal information by employing social engineering techniques and mimicking security practices. Researchers identified this kit after the threat actor responsible planted it on their WordPress honeypot. Researchers discovered that the actor was brute forcing into legitimate WordPress websites that have previously been compromised in order to inject the phishing kit via a file management plugin. The actor then attempted to make the fraudulent website look professional by disguising it as the original PayPal site, including using the PayPal graphical interface elements and "htaccess" to rewrite the URL so it does not include the "PHP" file extension. The site also includes a CAPTCHA, which further assists in creating a false sense of