Microsoft has seized 240 domains used by customers of ONNX, a phishing-as-a-service (PhaaS) platform, to target companies and individuals across the United States and worldwide since at least 2017.
According to
Microsoft's Digital Defense Report 2024, ONNX (also known as Caffeine and FUHRER) was the top Adversary in the Middle (AitM) phishing service by volume of phishing messages during the first half of 2024. Tens to hundreds of millions of phishing emails targeted Microsoft 365 accounts each month and customers of various other tech companies.
"These 'do it yourself' kits make up a significant portion of the tens to hundreds of millions of phishing messages observed by Microsoft each month and the fraudulent ONNX operation was a top 5 supplier in the first half of 2024," Microsoft told BleepingComputer.
"The fraudulent ONNX operation offered phishing kits designed to target a variety of companies across the technology sector, including Google, DropBox, Rackspace, and Microsoft."
ONNX promoted and sold the phish kits on Telegram using several subscription models (Basic, Professional, and Enterprise), ranging from $150 to $550 monthly.
The attacks, also controlled via Telegram bots, came with built-in two-factor authentication (2FA) bypass mechanisms and
most recently targeted financial firms' employees (at banks, credit union service providers, and private funding firms) using QR code phishing (also known as quashing) tactics.
These emails included PDF attachments containing malicious QR codes that redirected potential victims to pages resembling legitimate Microsoft 365 login pages and asked them to enter their credentials.
"Threat actors leverage quishing attacks because victims will typically scan QR codes on their personal mobile devices (which the victim may use for business purposes, as part of their firms' Bring Your Own Device (BYOD) program)," U.S. securities industry regulator FINRA also warned in a
recent alert. "As a result, these attacks are exceptionally difficult to monitor with typical endpoint detection."
