Freemium phishing service makes stealing passwords dead simple

Stealing passwords isn’t hard: just set up a fake login page and ask people to sign in. It’s called phishing, and its big business in the cybercrime world. Big enough that some “entrepreneurs” in Russia are offering phishing as a freemium service.

It’s called “Fake-Game,” and security researchers at Fortinet point out it’s been online for over a year. Over 60,000 active users have stolen nearly 700,000 passwords using the “service,” which makes stealing passwords as simple as sharing a link.

Instead of creating and hosting a fake login page themselves, users can simply select a service they’d like to compromise and copy a URL. Share that URL with would-be victims and the cloud-based service will serve up convincing login pages. Users will be notified when someone takes the bait.