New research has revealed the creator of the commercially available 16Shop phishing kit is double dipping and is surreptitiously capturing the information stolen by his customers.
Akamai said the alleged developer, an Indonesian they believe goes by handle Riswanda, has no qualms about taking advantage of the criminals who license his phishing kit and has installed a backdoor that makes a copy of the data being stolen and then storing it on Telegram, said Akamai researcher Amiram Cohen.
The backdoor was discovered while researchers sifted through the malware’s code and came across this snippet extract(valid($valid($image($data,5126))));, which were hidden in an American Express image using steganography. This level of obfuscation leads Cohen to believe that those using this kit are they themselves being ripped off.
“The highly obfuscated code collects information for all of the forms visited by the victim, and no matter what storage and delivery options are selected by the 16Shop operator, the victim's data is siphoned off and sent to the Telegram bot via API calls,” Cohen reported.
The phishing kit itself is described by Cohen as “highly sophisticated” capable of altering its layout and presentation for mobile and desktop victims and supports 10 languages. And while Riswanda has no problems stealing from his customers, he makes sure they cannot copy his malware by installing code protections stop it from operating if the license is invalidated.
