What is Account Farming in Phishing?

Account farming is a systematic technique employed by attackers to either create new accounts or compromise existing ones on various platforms to assist in launching more effective phishing attacks and other malicious operations.

Account farming is the process of creating or compromising multiple accounts to facilitate phishing and broaden an attacker’s reach or persistence.

Why It Matters

Account farming is a vital component of sophisticated phishing operations. It allows attackers to massively expand their footprint and perpetuate further attacks with more plausible and credible sources. By farming accounts, attackers can wield greater influence over unsuspecting users, as the compromised or newly created accounts often appear legitimate and trusted. This gives phishers enhanced capabilities to deceive targets, spread malware, or engage in more intricate social engineering plots.

Operators utilize account farming as a means to bypass typical anti-phishing defenses, as messages sent from known or legitimate-seeming accounts are more likely to pass security filters. Furthermore, the proliferation of stolen or fake accounts can be leveraged to craft a network of deceptive social proofs, reinforcing trust through sheer numbers, which is crucial when launching large-scale phishing campaigns.

In Practice

Example 1: On a large educational platform, a threat actor systematically creates new accounts using a script that bypasses CAPTCHA challenges. These accounts are then enhanced with plausible user data, such as profile pictures and bios lifted from real users’ publicly available data. With a critical mass of these accounts, they begin sending phishing emails to students and faculty appearing as legitimate announcements from the school, prompting users to click on a malicious link to “update their student records.” The link redirects to a credential-harvesting page.

Example 2: A malicious organization gains access to a series of corporate email accounts using credential stuffing attacks, taking advantage of poor password practices and previously breached password data. From these compromised accounts, they launch a coordinated phishing campaign targeting the company’s vendors, posing as executives requesting urgent wire transfers or finance department data. This method is highly effective due to the high trust level associated with these internal accounts.

Example 3: Leveraging a flaw in a social media network’s account creation API, attackers create thousands of bot-controlled accounts. These accounts are used to promote phishing links through posts and direct messages that claim to offer free gift cards or other enticing rewards in exchange for “verifying your account” on a phishing page designed to capture login credentials. This tactic not only harvests credentials but also feeds back into the cycle by further seeding fake account creation through credentials obtained.

Related Terms

Understanding account farming also requires familiarity with related techniques. Credential Stuffing involves using lists of compromised credentials to gain unauthorized access to accounts. Social Engineering is the art of manipulating people into performing actions or divulging confidential information. Additionally, Phishing Ecosystems refer to the interconnected infrastructure of tools and techniques that support phishing attacks, including account farming.

References

For further reading on account farming and its implication in cyber threats, you can refer to SANS Internet Storm Center’s detailed diary entry. Additional insights can be found in This Research Article on Credential Exploitation.