Information from cybersecurity solutions provider Fortinet reveals that threat actors have been selling “affordable” phishing kits on the darknet. These kits contain tools that enable cybercriminals to impersonate presidential candidates and their campaigns.
Fortinet’s research arm, FortiGuard Labs, discovered phishing kits priced at $1,260 each. These kits are designed to steal personal information, including names, addresses, and credit card (donation) details.
“Cyber adversaries, including state-sponsored actors and hacktivist groups, are increasingly active leading up to major events like elections,” Derek Manky, chief security strategist and VP of Global Threat Intelligence at Fortinet, said in a media release.
Apart from the phishing kits, security researchers identified more than 1,000 newly registered domain names incorporating election-related terms and references to prominent political figures since the beginning of 2024.
Infostealers
Although Fortinet did not directly link the domains to the phishing kits, the company found billions of records from the US for sale on darknet forums. These include Social Security numbers (SSNs), personally identifiable information (PII), and credentials that could be used in misinformation campaigns and lead to fraudulent activity, phishing scams, and account takeovers.
“Approximately 3% of the posts on darknet forums involve databases related to business and government entities,” Fortinet stated.
FortiGuard Labs researchers also reported a 28% increase in ransomware attacks against the US government year-over-year based on observed leak sites.
“Remaining vigilant and identifying and analyzing potential cyberthreats and vulnerabilities is crucial for preparing and safeguarding against the lures and targeted cyberattacks that could take advantage of heightened moments and even disrupt or influence electoral outcomes,” Manky added.