What is Account Farming in Phishing?

Account Farming in Phishing: The systematic creation or acquisition of numerous user accounts, exploited strategically to bypass security measures and enhance the credibility of phishing campaigns.

Why It Matters

Account farming plays a crucial operational role in phishing and social engineering tactics, techniques, and procedures (TTPs). By generating or acquiring a large number of accounts, attackers enhance their ability to conduct widespread phishing campaigns with a higher probability of success. These accounts are used to bypass detection mechanisms and present phishing emails as legitimate, originating from trusted sources. For practitioners, encountering account farming means spotting not just a singular threat but a potentially massive, coordinated campaign involving multiple seemingly authentic accounts.

The practice of account farming isn’t limited to email accounts; it can extend to social media profiles and other online service accounts that can be used to distribute malware or engage targets through diverse platforms. This increases the reach and effectiveness of the phishing campaigns, presenting a greater challenge for cyber defenders who must differentiate legitimate account activity from malicious operations.

In Practice

In a real-world scenario, account farming might appear as follows: an attacker uses a pool of many hijacked or freshly created accounts on a popular email service like Gmail. Each of these accounts is individually validated to avoid triggering bulk registration alarms. Once the accounts are active, they can be used to send phishing emails that appear legitimate due to their clean history and lack of bad reputation scores.


Subject: Important Update on Your Account!



Dear User,



We noticed unusual activity on your account and urge you to verify your identity. Please enter your login details at the following secure page: 

<a href="http://secure-login.yourbank-service.com">Verify Now</a>



Thank you for your prompt attention to this matter.



Best,

YOURBANK Support Team

Another example involves utilizing compromised social media accounts to broadcast malicious links or offer fake customer support interactions. Attackers leverage these accounts to post links under the guise of promotions or urgent alerts, driving unsuspecting users to phishing sites. Here, the credibility comes from the established trust the account had prior to being farmed.

Consider an attacker simulating a trusted customer support entity on Twitter. They use a high-quality account farmed specifically for this purpose, replying to user inquiries with malicious links or requests for sensitive information under the pretense of troubleshooting.

Related Terms

Account farming is closely related to social engineering, which involves manipulating people into divulging confidential information. It’s also interconnected with phishing simulation, a technique used by security teams to preemptively test and improve their defenses against such tactics. Lastly, understanding email spoofing is essential, as it often works in conjunction with account farming to deceive targets.

References

Account Farming as a Phishing Strategy provides a deeper dive into how attackers leverage account farming to strengthen their campaigns. Additionally, CSO Online’s explanation of phishing strategies offers insight into various techniques that enrich and complicate modern phishing tactics.