January 24, 2023 By Jonathan Reed 2 min read

Recently, investigators at Mandiant discovered a new software platform with an intuitive interface. The service has tools to orchestrate and automate core campaign elements. Some of the platform’s features enable self-service customization and campaign tracking.

Sounds like a typical Software-as-a-Service (SaaS) operation, right? Well, this time, it’s Caffeine, the latest Phishing-as-a-Service (PhaaS) platform. A basic subscription costs $250 a month; all you need is an email to sign up.

How caffeine PhaaS is different

PhaaS vendors advertise and sell their products as phishing kits. A phishing kit includes everything required to launch a successful phishing attack, such as email templates and even templates for rogue websites to send victims to. Some phishing kits also include lists of potential targets.

As per Mandiant, what makes Caffeine different from most other PhaaS offerings is its low barrier of entry. To sign up for Caffeine services, only an email is required. Unlike Caffeine, other PhaaS platforms typically only communicate through referrals, underground forums or encrypted messaging. Also, Caffeine provides email templates directed at Russian and Chinese targets, which is unusual for PhaaS.

Other Caffeine features include:

  • Tools to orchestrate and automate phishing campaigns
  • Self-service phishing kit customization
  • Capability to manage intermediary redirect pages and final-stage lure pages
  • Dynamic URL generation for hosted malicious payloads
  • Ability to track campaign email activity
  • Caffeine news feed: announces feature updates and expansions of accepted cryptocurrencies.

According to Mandiant, the average PhaaS platform costs from $50 to $80, making Caffeine relatively expensive. Caffeine may be pricier due to its unlimited customer service support options and its extensive anti-detection and anti-analysis features.

Rise of commercialized attack services

Caffeine represents a continued trend of Cyber-Crime-as-a-Service, which makes it easy for non-technical adversaries to launch massive attacks. Like legitimate subscription-based software, the programming and business organization behind these attack platforms is highly sophisticated. Caffeine even offers three service tiers (Basic, Professional and Enterprise at $250, $450 and $850 per month, respectively).

Undoubtedly, security professionals wince when they compare the low cost of phishing services versus the $4.35 million average cost of a data breach.

Phishing attack protection

Given the ease of access to phishing attack kits, companies must implement effective anti-phishing security. Training employees to be aware of these scams is a key starting point. Some organizations will even send out internal bogus phishing emails to keep team members on their toes. Still, even with the best training, attacks can slip through the cracks. For this reason, more comprehensive strategies are required.

Solutions, such as security information and event management (SIEM), have evolved to include advanced analytics such as user behavior analytics (UBA), network flow insights and artificial intelligence (AI) to accelerate detection. SIEM also integrates with security orchestration, automation and response (SOAR) platforms for incident response and remediation.

Other approaches, such as zero trust, manage privileged access to ensure that users are only granted access to data essential to their jobs.

The growth of nefarious services like Caffeine makes us jittery. Solid, well-developed security can help keep us calm.

More from Risk Management

Airplane cybersecurity: Past, present, future

4 min read - With most aviation processes now digitized, airlines and the aviation industry as a whole must prioritize cybersecurity. If a cyber criminal launches an attack that affects a system involved in aviation — either an airline’s system or a third-party vendor — the entire process, from safety to passenger comfort, may be impacted.To improve security in the aviation industry, the FAA recently proposed new rules to tighten cybersecurity on airplanes. These rules would “protect the equipment, systems and networks of transport…

Protecting your digital assets from non-human identity attacks

4 min read - Untethered data accessibility and workflow automation are now foundational elements of most digital infrastructures. With the right applications and protocols in place, businesses no longer need to feel restricted by their lack of manpower or technical capabilities — machines are now filling those gaps.The use of non-human identities (NHIs) to power business-critical applications — especially those used in cloud computing environments or when facilitating service-to-service connections — has opened the doors for seamless operational efficiency. Unfortunately, these doors aren’t the…

Cybersecurity dominates concerns among the C-suite, small businesses and the nation

4 min read - Once relegated to the fringes of business operations, cybersecurity has evolved into a front-and-center concern for organizations worldwide. What was once considered a technical issue managed by IT departments has become a boardroom topic of utmost importance. With the rise of sophisticated cyberattacks, the growing use of generative AI by threat actors and massive data breach costs, it is no longer a question of whether cybersecurity matters but how deeply it affects every facet of modern operations.The 2024 Allianz Risk…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today