A newly discovered phishing kit targeting PayPal users is trying to steal a large set of personal information from victims that includes government identification documents and photos.
一个新发现的针对 PayPal 用户的网络钓鱼工具包，正试图从受害者那里窃取大量个人信息，其中包括政府身份证明文件和照片。
Over 400 million individuals and companies are using PayPal as an online payment solution.
超过4 亿个人和公司正在使用 PayPal 作为在线支付解决方案。
The kit is hosted on legitimate WordPress websites that have been hacked, which allows it to evade detection to a certain degree.
该工具包托管在已被黑客入侵的合法 WordPress 网站上，这使其能够在一定程度上规避检测。
Breaching websites with weak login
登录弱口令的网站
Researchers at internet technology company Akamai found the phishing kit after the threat actor planted it on their WordPress honeypot.
互联网技术公司 Akamai 的研究人员，在攻击者将其植入他们的 WordPress 蜜罐后，发现了该网络钓鱼工具包。
The threat actor targets poorly secured websites and brute-forces their log in using a list of common credential pairs found online. They use this access to install a file management plugin that allows uploading the phishing kit to the breached site.
威胁行为者针对安全性较差的网站，并使用网上找到的常用密码列表，对网站进行*力暴**破解。他们登陆成功后安装文件管理插件，该插件允许将网络钓鱼工具包上传到被破坏的站点。
Akamai discovered that one method the phishing kit uses to avoid detection is to cross-reference IP addresses to domains belonging to a specific set of companies, including some orgs in the cybersecurity industry.
Akamai 发现网络钓鱼工具包用来避免检测的一种方法，是将 IP 地址交叉引用到属于特定公司的域名，包括网络安全企业。
Legit-looking page
看似合法的页面
The researchers noticed that the author of the phishing kit made an effort to make the fraudulent page look professional and mimic the original PayPal site as much as possible.
研究人员注意到，网络钓鱼工具包的作者，极力使诈骗页面看起来很专业，并尽可能地模仿原始的PayPal 网站。
One aspect they observed was that the author uses htaccess to rewrite the URL so that it does not end with the extension of the PHP file. This adds to a cleaner, more polished appearance that lends legitimacy.
他们观察到的一个方面是作者使用 htaccess 重写 URL，使其不以 PHP 文件的扩展名结尾。这让网页外观看起来更整洁亮丽，从而增加了合法性。
Also, all graphical interface elements in the forms are styled after PayPal's theme, so the phishing pages have a seemingly authentic appearance.
此外，表单中的所有图形界面元素均采用 PayPal 主题样式，因此网络钓鱼页面具有看似真实的外观。
Data stealing process
数据窃取过程
Stealing a victim's personal data starts with presenting them a CAPTCHA challenge, a step that creates a false sense of legitimacy.
窃取受害者的个人数据，首先面临的挑战是验证码，这一步骤会造成虚假的合法性。
After this stage, the victim is asked to log into their PayPal account using their email address and password, which are automatically delivered to the threat actor.
在这个阶段之后，受害者被要求使用他们的电子邮件地址和密码，登录他们的 PayPal 账户，这些信息会自动发送给攻击者。
This is not all, though. Under the pretense of "unusual activity" associated with the victim's account, the threat actor asks for more verification information.
不过，这还不是全部。攻击者以受害者帐户的“异常活动”为借口，要求提供更多验证信息。
In a subsequent page, the victim is asked to provide a host of personal and financial details that include payment card data along with the card verification code, physical address, social security number, mother's maiden name.
在随后的页面中，要求受害者提供大量个人和财务详细信息，包括支付卡数据以及卡验证码、实际地址、社保卡号、娘家姓氏。
It appears that the phishing kit was built to squeeze all the personal information from the victim. Apart from the card data typically collected in phishing scams, this one also demands the social security number, mother's maiden name, and even the card's PIN number for transactions at ATM machines.
网络钓鱼工具包似乎是为了从受害者那里，窃取所有个人信息而构建的。除了通常在网络钓鱼诈骗中收集的卡数据外，该数据还需要社保卡号，娘家姓氏，甚至在ATM机上交易卡的PIN码。
Collecting this much information is not typical to phishing kits. However, this one goes even further and asks victims to link their email account to PayPal. This would give the attacker a token that could be used to access the contents of the provided email address.
收集这么多信息对于网络钓鱼工具包来说并不常见。然而，这个更进一步，要求受害者将他们的电子邮件帐户链接到 PayPal。这将为攻击者提供一个令牌，该令牌可用于访问所提供电子邮件地址的内容。
Despite having collected a massive amount of personal information, the threat actor is not finished. In the next step, they ask the victim to upload their official identification documents to confirm their identity.
尽管已经收集了大量的个人信息，但攻击者还没有结束。在下一步中，他们要求受害者上传他们的官方身份证明文件以确认他们的身份。
The accepted documents are passport, national ID, or a driver's license and the upload procedure comes with specific instructions, just as PayPal or a legitimate service would ask from their users.
接受的文件是护照、身份证或驾驶证，上传过程带有特定说明，就像 PayPal 或合法服务向用户询问一样。
Cybercriminals could use all this information for a variety of illegal activities ranging from anything related to identity theft to launder money (e.g. creating cryptocurrency trading accounts, registering companies) and maintaining anonymity when purchasing services to taking over banking accounts or cloning payment cards.
网络犯罪分子可以将这些所有信息，用于各种非法活动，从身份盗窃相关的任何事情到洗钱（例如创建加密货币交易账户、注册公司）以及在购买服务时保持匿名，再到接管银行账户或克隆支付卡。
Uploading government documents and taking a selfie to verify them is a bigger ballgame for a victim than just losing credit card information — it could be used to create cryptocurrency trading accounts under the victim's name. These could then be used to launder money, evade taxes, or provide anonymity for other cybercrimes. - Akamai
上传政府文件并自拍进行验证，对受害者来说是一场比丢失信用卡信息更大的灾难——它可以用来以受害者的名义创建加密货币交易账户。然后这些可用于洗钱、*税逃**或为其他网络犯罪提供匿名性。-阿卡迈
Although the phishing kit appears sophisticated, the researchers discovered that its file upload feature comes with a vulnerability that could be exploited to upload a web shell and take control of the compromised website.
尽管网络钓鱼工具包看起来很复杂，但研究人员发现其文件上传功能带有一个漏洞，可以利用该漏洞上传 web shell 并控制受感染的网站。
Provided the huge amount of information requested, the scam may appear obvious to some users. However, Akamai researchers believe that this specific social engineering element is what makes the kit successful.
如果请求的信息量很大，那么对于某些用户来说，这个*局骗**可能会很明显。然而，Akamai 研究人员认为，这种特定的社会工程部分是成功的原因。
They explain that identity verification is normal these days and this can be done in multiple ways. "People judge brands and companies on their security measures these days," the researchers say.
他们解释说，如今身份验证很正常，可以通过多种方式完成。研究人员说：“如今，人们根据他们的安全措施来评判品牌和公司。”
The use of the captcha challenge signals from the beginning that additional verification may be expected. By using the same methods as legitimate services, the threat actor solidifies the victim's trust.
验证码的使用从一开始就表明需要额外的验证。通过使用与合法服务相同的方法，攻击者获得了受害者的信任。
Users are advised to check the domain name of a page asking for sensitive information. They can also go to the official page of the service, by typing it manually in the browser, to check if identity verification is in order.
建议用户检查要求获取敏感信息页面的域名。他们还可以通过在浏览器中手动输入来访问该服务的官方页面，以检查身份验证是否正常。
轻则失根，躁则失君。
——《道德经.第二十六章》
本文翻译自：
https://www.bleepingcomputer.com/news/security/paypal-phishing-kit-added-to-hacked-wordpress-sites-for-full-id-theft/
如若转载，请注明原文地址