A new Phishing-as-a-Service (PaaS) platform dubbed “EvilProxy” has been discovered by Resecurity researchers. PaaS platforms allow low-skill threat actors to easily steal online account information. EvilProxy is a reverse-proxy PaaS platform that sits between the victim and a legitimate authentication endpoint. If a victim lands on an EvilProxy site, the site asks for the user’s credentials and multi-factor authentication token which are forwarded to the legitimate server. The threat actor then stores the session cookie that is returned by the website and relays it back to the user, allowing the threat actor to log in as the user without any indication to the victim that something malicious has occurred. While sophisticated threat actors have been using this technique for years, the sale of this tool on underground forums allows any threat actor, skilled or not, to phish user credentials from popular websites. EvilProxy advertises close to fifteen (15) different websites available to phish, including Google, Microsoft, iCloud, Dropbox, GitHub, Facebook, WordPress, PyPi, and other popular websites. Once a threat actor chooses a website to replicate, they are given access to a configuration panel hosted on Tor with detailed instructions on how to set up the phishing site. The researchers noted that the developers of EvilProxy “did a great job in terms of the service usability, and configurability of new campaigns, traffic flows, and data collection.” EvilProxy also attempts to guard against scanning from services like VirusTotal, blocks VPN services and TOR exit nodes, and fingerprints browsers to determine if the potential victim is a bot. The emergence of EvilProxy as a well-made and effective phishing toolkit gives unsophisticated threat actors an easy path to starting phishing campaigns. CTIX analysts will continue to monitor the usage of this service and will provide updates on new developments.