Netskope Threat Research Labs recently discovered a Phishing-as-a-Service (PhaaS) platform named Hackshit, that records the credentials of the phished bait victims. The phished bait pages are packaged with base64 encoding and served from secure (HTTPS) websites with “.moe” top level domain (TLD) to evade traditional scanners. “.moe” TLD is intended for the purpose of ‘The marketing of products or services deemed’. The victim’s credentials are sent to the Hackshit PhaaS platform via websockets. The Netskope Active Platform can proactively protect customers by creating custom applications and a policy to block all the activities related to Hackshit PhaaS. This blog will detail the discovery of Hackshit PhaaS, the inner working and revenue model of this PhaaS platform.
Discovery of the PhaaS
During our ongoing research about the trends of CloudPhishing attacks, we observed a phishing page using data URI scheme to serve base64 encoded content (data:text/html;base64) delivered from “https://a.safe.moe”. When the link was accessed, it presented a phished Google Docs page asking for credentials as shown in Figure 1.

Figure 1: First phished page asking for credentials
Once the credentials are entered, it presented another phishing page whose source uses a data URI scheme to serve base64 en