What is Automated Cybercrime in Phishing?

Understanding the landscape of phishing and social engineering techniques is crucial in modern cybersecurity. A key component of today’s threat environment is the concept of Automated Cybercrime, particularly in phishing, which leverages technology to scale and refine attacks.

Definition

“Automated Cybercrime” in phishing refers to the utilization of software tools and scripts by attackers to execute large-scale phishing campaigns with minimal human intervention, maximizing efficiency and reach.

Why It Matters

The significance of automated cybercrime lies in its ability to exponentially increase the scale and frequency of phishing attacks. For an operator executing these campaigns, automation tools allow for the handling of millions of emails and potential victim interactions in a fraction of the time a manual approach would require. For targets, this means a persistent threat environment where phishing attempts are more frequent and can be tailored quickly to avoid detection.

Automation also provides the capability to dynamically vary attack vectors. For example, automated systems can modify email content, sender addresses, and subject lines on-the-fly to adapt to targets’ defenses or to keep the attack fresh and unfiltered by security software. This adaptability makes phishing campaigns more effective and the chances of a successful breach significantly higher.

In Practice

Consider a scenario where a threat actor uses a tool like GoPhish, which allows setup of an email campaign designed to mimic a major cloud service’s invoice. The tool can automate the customization of each email to include unique identifiers, ensuring phishing emails appear legitimate:


Subject: [Invoice] Your Recent Purchase Order — View Details

From: billing@cloudservices-billing.net

Body: Dear [User], Your recent order has been processed. View your invoice here: [malicious link]

Another instance of automated cybercrime can be seen with the use of credential harvester kits like Evilginx2, which automate the setup of phishing pages that mirror popular web services. When a victim navigates to a page like “login-service-verification.com,” Evilginx2 captures credentials and session cookies, presenting a seamless replica of the login interface users expect:


Domain: login-service-verification.com

URL Path: /auth/verify/[unique-id]

Server: Automated redirect to phishing content hosted externally

A further example involves automating domain generation and registration so that DNS-based filtering becomes less effective. Using a tool like a Domain Generation Algorithm (DGA), attackers can rapidly create and deploy new domain names for phishing campaigns, keeping ahead of blacklists:


Domains: secure-account-updates8647.com, verification-login4023.net

Related Terms

As you deepen your understanding of phishing and automated cybercrime, consider diving into related concepts such as Spear Phishing — targeted phishing aimed at specific individuals, Phishing Kits — pre-packaged phishing attack templates, and Botnets — networks of infected devices used to perform coordinated cyber attacks.

References

Key insights and examples in this article are underpinned by resources like the Internet Storm Center’s discussions of automated phishing threats and methodologies. Further technical detail can be found in articles about email security strategies and defenses.