Phishing domains associated with LabHost PhaaS platform users
The Federal Bureau of Investigation (FBI) is releasing this FLASH to disseminate 42,000 phishing domains linked to the LabHost phishing-as-a-service (PhaaS) platform between November 2021 and April 2024. Prior to being disabled by law enforcement in April 2024, LabHost was one of the world’s largest PhaaS providers, offering a range of illicit services for approximately 10,000 users. The platform enabled cyber criminals to impersonate more than 200 organizations, including major banks and government institutions, in an effort to collect personal information and banking credentials from unsuspecting victims worldwide. The FBI is releasing this information to maximize awareness and provide indicators of compromise that may be used by recipients for research and defense.
LabHost provided numerous phishing services to their customers including, but not limited to: infrastructure configuration/support, customized phishing pages, adversary-in-the-middle proxy connections to obtain two-factor authentication (2FA) codes, smishing services, and stolen credential management.
LabHost’s infrastructure stored over one million user credentials and nearly 500,000 compromised credit cards, enabling financial theft, various fraud schemes, and money laundering by its users.
LabHost offered a variety of phishing pages and, for an additional cost, creation of bespoke pages. Once a victim clicked a phishing page link and entered their details, LabHost servers received the captured information and delivered it to the LabHost customer. LabHost collected personally identifiable information (PII), credentials, and credit card information.
LabHost phishing domains were configured to impersonate over 200 trusted sites, including spoofed pages for banks, online streaming platforms, government agencies, postal services, and more. Law enforcement action identified over 42,000 unique domains associated with the platform, impacting over a million victims worldwide.