Meet Spox Phishing Kit for carding

What is phishing kit?

Phishing kits are generally kits provided by cyber-criminals to allow anyone with a little bit of IT knowledge to carry out a phishing attack. 

How did i discovered this?
During a recent investigation of client’s web space in a dedicated server, a hack attempt(dict attack) to wordpress’s xmlrpc.php found. So, I tracked ‘hacker’s cyber footprints in apache logs and it led me to Sp0x’s phishing kit :)

What does hacker do with Sp0x Chase phishing kit in server?
Hacker deploy phishing pages and targeting bank customers using random infected servers.

Victims were directed to these pages through a phishing email which contained social engineering text and a link to the phishing page URL.

Phishing Behavior:
Sp0x Kit generates pages used to steal data from victims.

1. part of workflow starts with a homepage that appears to be the fake banking login page.
   
   

   

2. The workflow leads the victim to a series of phishing pages asking for the victim’s email account login information, personal data, and payment card details.

3. The stolen data stores in .txt files on the server hosting the phishing pages.
   

   

IMPORTANT: Included in this phishing kit is an admin panel backend that allows the attacker to change some of the phishing page settings, including the email address used to collect the stolen data and the various anti-bot countermeasures.

multiple bot countermeasure files:

include'Spox/Anti/IP-BlackList.php';
include'Spox/Anti/Bot-Crawler.php';
include'Spox/Anti/Bot-Spox.php';
include'Spox/Anti/blacklist.php';
include'Spox/Anti/new.php';
include'Spox/Functions/Fuck-you.php';
include'Spox/Anti/Dila_DZ.php';

More details about author:

/**
 * DO NOT SELL THIS SCRIPT ! 
 * DO NOT CHANGE COPYRIGHT !
 * Chase -
 * version 3.0
 * icq & telegram = @spoxcoder
###############################################
#$            C0d3d by Spox_dz               $#
#$   Recording doesn't  make you a Coder     $#
#$          Copyright 2020 Chase             $#
###############################################
**/

The author of this Chase phishing kit, Spox, charges $200 USD for the latest version of the phishing kit.

Wish you a safe day!