Chinese Threat Actors Ditch Static Phishing Pages for Live Credential Interception

Key Points:

• Chinese threat actors are evolving their phishing tactics by transitioning from static password harvesting to real-time credential interception using sophisticated phishing-as-a-service (PhaaS) offerings.
• The impact includes the ability to bypass multifactor authentication (MFA) by capturing one-time passcodes (OTPs) in real-time, primarily targeting non-Chinese entities across countries like Japan, the US, and Australia.
• Recommended actions include enhancing detection capabilities against phishing attempts, implementing robust MFA solutions that are less susceptible to interception, and educating users about the risks of encrypted messaging platforms.

Technical Details: The report highlights the use of live administration panels for real-time credential theft and mentions the Darcula PhaaS platform linked to threat actor UNC5814, which utilizes AI for generating unique phishing pages.

MITRE ATT&CK Techniques:

• T1566.001 - Phishing: Spearphishing Link (Initial Access)
• T1071.001 - Application Layer Protocol: Web Protocols (Command and Control)
• T1203 - User Execution (Execution)

IOCs Mentioned: None mentioned.