Published on: April 22, 2024
In a sweeping international law enforcement effort, a major online platform known as LabHost, which has been instrumental in supplying cybercriminals with phishing kits, has been dismantled. The operation, led by the Metropolitan Police of the United Kingdom and coordinated by the European Union’s law enforcement agency Europol, involved authorities from 19 countries and has led to the arrest of 37 suspects.
Established in 2021, LabHost was specifically designed to facilitate the creation of fraudulent websites, enabling attackers to deceive individuals into disclosing sensitive information such as email addresses, passwords, and banking details. According to the Metropolitan Police, LabHost had grossed nearly £1 million (approximately $1,173,000) by offering its services to about 2,000 registered users who paid monthly subscription fees.
“With a monthly fee averaging $249, LabHost would offer a range of illicit services which were customizable and could be deployed with a few clicks,” Europol said. “Depending on the subscription, criminals were provided an escalating scope of targets from financial institutions, postal delivery services, and telecommunication services providers, among others. Labhost offered a menu of over 170 fake websites providing convincing phishing pages for its users to choose from.”
Over the course of the operation, which spanned from Sunday to Wednesday, more than 70 locations were searched globally, revealing a vast network of approximately 40,000 phishing domains. These domains targeted a diverse range of victims including financial institutions, postal services, and telecommunications providers.
Europol’s investigation also uncovered that LabHost was responsible for obtaining around 480,000 bank card numbers and over 64,000 PINs, along with more than 1 million passwords for various online services.
Among the tools offered by LabHost was “LabRat,” a campaign management tool that allowed criminals to orchestrate and monitor phishing attacks in real-time. This tool was noted for its ability to circumvent advanced security protocols, including two-factor authentication, thereby enhancing the efficacy of the phishing attacks initiated through the platform.