Hunting Phish Kits

Josh Rickard opens with his background in digital forensics and his years fighting phishing at scale, including an internal reporting tool that grew to millions of installs. He frames the problem as a shared one: most organizations run similar defenses, and a standard process of user reporting, header and link extraction, lookups and mailbox cleanup still leaves gaps.

The core of the talk is phishing kits, which are packaged web applications an attacker can unzip onto a server and configure with a small edit. Rickard walks through their typical contents: image folders, .htaccess and robots.txt files that filter bots and scanners, anti-bot PHP scripts, crude card validation, and logs that sometimes reveal the testers' own IP addresses. He shows how kits change across versions and groups, and how decoding obfuscated code can expose the email addresses where captured credentials are sent, sometimes exposing the kit builders themselves.

He argues that defenders should retrieve a kit as soon as a phishing message is reported, record its names, versions, hosting and collection addresses, and share indicators publicly so others can build detections. He points to tools he created for posting suspicious URLs to Twitter and for scraping kit repositories, and encourages collaboration over waiting for vendors to solve the problem.