Recently, investigators at Mandiant discovered a new software platform with an intuitive interface. The service has tools to orchestrate and automate core campaign elements. Some of the platform’s features enable self-service customization and campaign tracking.

Sounds like a typical Software-as-a-Service (SaaS) operation, right? Well, this time, it’s Caffeine, the latest Phishing-as-a-Service (PhaaS) platform. A basic subscription costs $250 a month; all you need is an email to sign up.

How caffeine PhaaS is different

PhaaS vendors advertise and sell their products as phishing kits. A phishing kit includes everything required to launch a successful phishing attack, such as email templates and even templates for rogue websites to send victims to. Some phishing kits also include lists of potential targets.

As per Mandiant, what makes Caffeine different from most other PhaaS offerings is its low barrier of entry. To sign up for Caffeine services, only an email is required. Unlike Caffeine, other PhaaS platforms typically only communicate through referrals, underground forums or encrypted messaging. Also, Caffeine provides email templates directed at Russian and Chinese targets, which is unusual for PhaaS.

Other Caffeine features include:

• Tools to orchestrate and automate phishing campaigns
• Self-service phishing kit customization
• Capability to manage intermediary redirect pages and final-stage lure pages
• Dynamic URL generation for hosted malicious payloads
• Ability to track campaign email activity
• Caffeine news feed: announces feature updates and expansions of accepted cryptocurrencies.

According to Mandiant, the average PhaaS platform costs from $50 to $80, making Caffeine relatively expensive. Caffeine may be pricier due to its unlimited customer service support options and its extensive anti-detection and anti-analysis features.

Rise of commercialized attack services

Caffeine represents a continued trend of Cyber-Crime-as-a-Service, which makes it easy for non-technical adversaries to launch massive attacks. Like legitimate subscription-based software, the programming and business organization behind these attack platforms is highly sophisticated. Caffeine even offers three service tiers (Basic, Professional and Enterprise at $250, $450 and $850 per month, respectively).

Undoubtedly, security professionals wince when they compare the low cost of phishing services versus the $4.35 million average cost of a data breach.

Phishing attack protection

Given the ease of access to phishing attack kits, companies must implement effective anti-phishing security. Training employees to be aware of these scams is a key starting point. Some organizations will even send out internal bogus phishing emails to keep team members on their toes. Still, even with the best training, attacks can slip through the cracks. For this reason, more comprehensive strategies are required.

Solutions, such as security information and event management (SIEM), have evolved to include advanced analytics such as user behavior analytics (UBA), network flow insights and artificial intelligence (AI) to accelerate detection. SIEM also integrates with security orchestration, automation and response (SOAR) platforms for incident response and remediation.

Other approaches, such as zero trust, manage privileged access to ensure that users are only granted access to data essential to their jobs.

The growth of nefarious services like Caffeine makes us jittery. Solid, well-developed security can help keep us calm.