Early this week, Microsoft’s Threat Intelligence Team disclosed a large-scale phishing-as-a-service (PhaaS) operation known as “BulletProofLink” (as well as “BulletProftLink” or “Anthrax”). OSINT Fans first identified BulletProofLink in October of 2020 and published a three-part series about the operation, which is linked below. Microsoft security researchers, in their extensive report also linked below, explained that the BulletProofLink operation “sells phishing kits, hosting, and automated services at a relatively low cost” and “is responsible for many of the phishing campaigns that impact enterprises today”. It is also discussed that various threat groups utilize the service in either single or monthly subscription-based business models, as it has over one hundred (100) available templates that impersonate legitimate brands and services. BulletProofLink operates an online portal that allows for the threat groups to register and pay for the service, and the portal is believed to have been active since 2018. The operation advertises their toolset for $800 a month maximum on their portal as well as offer individual credential phishing templates for between $80 and $100. Microsoft researchers noted that the credentials stolen using the templates are not only sent to the customer but to the operators of BulletProofLink as well, which is known as “double theft”, to increase profits. The researchers also identified the use of the “infinite subdomain abuse” technique in the campaign that led to the operation disclosure, which allows for actors to assign unique URLs for each recipient with a single domain. This technique is a part of the phishing kit and occurs when actors “compromise a website’s DNS or when a compromised site is configured with a DNS that allows wildcard subdomains”. Microsoft released indicators of compromise (IOCs) regarding the identified password-processing URLs and domains of the operation at the conclusion of their report, and advised organizations to adhere to anti-phishing policies, multifactor authentication (MFA), and block all sign-in attempts from legacy authentication.