Researchers from Kaspersky have uncovered a phishing scheme utilizing a legitimate AI-driven web hosting platform to pilfer corporate login credentials. This operation, ongoing for the last month, saw more than 8,000 phishing emails dispatched in English, Korean, and Russian, targeting workers in various sectors like government, manufacturing, and sales. The cybercriminals leveraged Tencent EdgeOne Pages, a web app hosting service, to craft and house fake login pages mimicking corporate systems.
As per a statement by Kaspersky, employing trusted infrastructure rendered the phishing pages more challenging to spot, given that victims were directed to domains linked with a bona fide service. The fraudulent emails typically posed as internal departments such as IT support or human resources, urging recipients to update their account information. Upon submission, the stolen credentials were sent to servers managed by the attackers.
Researchers highlighted that this tactic mirrors a growing trend where threat actors are turning to artificial intelligence (AI) tools and user-friendly platforms to swiftly construct phishing setups with minimal technical knowledge.
