Phishers Hack Hosting Providers To Launch Mass Attacks

Spearphishing is hot, especially when it comes to targeted attacks. But for phishing campaigns looking for maximum impact and victims, the most popular method is to compromise legitimate hosting providers, and new data shows that vector on the rise worldwide.

According to the Anti-Phishing Working Group (APWG), some 47 percent of all phishing attacks the second half of 2012 were via hacked hosting providers. Phishers used 89,748 unique domain names in the second half of the year, up from 64,204 domains in the first half of the year.

Phishing via hosting provider works like this: The attacker breaks into a Web server hosting multiple domains -- a shared virtual server -- and launches phishing attacks on each domain on that server. It's an efficient method that allows the attacker to infect hundreds or even thousands of websites.

"Breaking into hosting facilities is a high-yield activity for phishers," says Rod Rasmussen, president and CTO of IID, and a co-author of the APWG study. "This activity is part of a larger trend -- we also see criminals hacking into shared hosting and using those servers for other malicious activities, such as launching denial-of-service attacks, infecting the computers of the legitimate website visitors via exploit code, and creating botnets."

There were 123,486 phishing attacks worldwide during the second half of 2012, up from 93,462 the first half of the year, a jump the APWG attributes to the virtual server breaches by phishers. Some 611 organizations were spoofed, including banks, e-commerce sites, social networks, ISPs, and online gaming. More than 80 percent of malicious domain registrations were in the .com, .tk, and .info domains.

The full report is available here (PDF) for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.