Cyber-crooks bank on free phishing kits

Cyber-crooks can now launch phishing attacks at no cost whatsoever

Security experts have discovered free phishing kits on the internet which allow cyber-crooks to send fraudulent emails.

Panda Security's PandaLabs said that the tools allow cyber-crooks to spoof bank pages, online pay platforms, Gmail and Yahoo Mail accounts, online games and blogs.

"The really amazing thing is that these kits are free," said Luis Corrons, technical director of PandaLabs.

"The number of phishing attacks increases due to the simplicity of the tools, causing companies and consumers large losses. A recent Gartner study found that phishing attacks caused US consumer losses of $3.2bn in 2007."

After accessing a URL that contains the kits, the criminal can obtain two files to create a fraudulent mail.

One file allows them to spoof emails from banks and pay platforms, and the other allows them to create a fraudulent page that resembles the original. The kit also includes a free PHP program to send emails from the spoofed page.

The rest of the process is similar to other phishing attacks. The false email is sent to several mail addresses with a link to a malicious page at which users are requested to enter personal data such as email addresses and banking passwords.

"Cyber-crooks buy lists of addresses on the internet, although some are free, " said Corrons. "If we add free hosting services, the result is that cyber-crooks can launch phishing attacks at no cost whatsoever."