Catching the Phisherman
summary
Investigation maps an active, automated Facebook Messenger phishing operation that uses an Android-emulator macro to harvest creds, then fans links across urlscan.io and Looky Lou indexed pages; an unauthenticated analytics widget exposes live sessions. Research finds about 900 domains averaging ~985,000 sessions each in 2022, estimates ad revenue $12–37M and credential sales ~$248k, reveals a SaaS-style dashboard with combos/clusters/users and a kingpin taking ~70%, and ties hosting to glitch.me and SamCart subdomains.
AI-written summary · about
chapters (7)
- 0:00Introduction and presenters
- 1:46The Facebook phishing campaign
- 10:10Tracking the phisherman's infrastructure
- 17:12Revenue and organizational scale
- 19:00Why this phishing matters
- 24:35Conclusion and awards
- 25:17Q&A
related talks
29mHook, Line, and Tinker: A Dive into Phishing Campaign Sites
32mSomething’s Phishy: See the Hook Before the Bait
40mGet Rich or Get Hunted Trying: Uncovering Large Scale Fraud Operations
54mDark Fairytales From A Phisherman
38mTeach a Man to Phish and You Feed Him for a Lifetime
58mCatching Transparent Phish: Understanding and Detecting MITM Phishing Kits
56mCybersecurity & Privacy From The Global Lens
26mTracking the World's Dumbest Cyber Mercenaries