credit card phishing - piles of credit cards with a fish hook on

Microsoft reports open redirection phishing tactics

Tim

1st September 2021

6 min read

Last week, the Microsoft Defender Threat Intelligence Team published details of a widespread phishing campaign using some very uncommon tactics. The attack used open redirect links, which redirected users to several pages, including a captcha page, before attempting to compromise the users’ credentials through multiple input forms.

Redirects are commonly seen in legitimate emails and phishing campaigns, which can make them more difficult to detect. Sales and marketing emails often use these links to direct users through a tracking link before redirecting them to the desired location.

Legitimate websites that allow open redirects are commonly used in a phishing campaign to trick users into trusting the link, as it is usually a popular and trusted domain. The following URL shows a common, yet insecure, use of a redirect parameter:

https://www.example.com/login.html?redirect=http%3A%2F%2Fevilsite.com

In this example, the redirect parameter is used to control the end destination of the user’s browser (http://evilsite.com) when they automatically follow the redirect.

Users trained to confirm the legitimacy of links by hovering over them may fail to notice parameters that the attacker has manipulated to redirect the user to a malicious website. Even the most astute user would likely fail to identify a malicious redirection if obfuscation tactics were used. Microsoft notes in its report that some traditional email gateway solutions may fail to recognise these links too.

Phishing has always represented a significant threat to businesses and individuals. However, since the emergence of COVID-19, these campaigns have increased. Microsoft reported in March 2020 that 91% of all cyber attacks originate using email.

This phishing campaign was notable for the wide variety of domains that were used. These include:

  • Compromised legitimate domains
  • Free email domains from numerous country-code Top-Level Domains (ccTLDs)
  • Attacker-owned Domain Generated Algorithm (DGA) domains

Microsoft reported that so far it has observed at least 350 unique phishing domains used.

The reported attacks followed a general pattern that displayed a box with a large button for the user to click. The emails impersonated many products with the subject lines varying accordingly. The focus seems to have been on impersonating Office 365 and Zoom. In the case of Office 365, a sample message included text that an email had been blocked and invited the user to review the blocked email.

Redirect links in these emails were used so that by hovering over the link it would appear at first glance to originate from a trusted domain. Microsoft revealed that the final domains that users were redirected to were most often a DGA and tended to use .xyz and .club TLDs.

Microsoft provided an example of the open redirect format used by one of these emails:

Clicking on this link would redirect the user to the attacker-controlled domain i.e., c-hi.xyz. 

When this page was loaded, the user would be presented with a Google reCAPTCHA prompt hosted on the attacker’s domain. Microsoft believes that this was likely used to evade page scanning, which would have prevented some phishing analysis systems from detecting the page as a phishing threat.

Users would then be taken to a page that impersonated a legitimate service such as Office 365 or Zoom and asked to submit credentials. The site used the recipients’ email, supplied as a Base64 encoded value in the URL, to be decoded and used to fill in the email address of the user. This technique is often used to increase trust. Microsoft reported that in some instances, the phishing pages also included the company’s logo and branding.

If a user entered their credentials on this page, some sites would return an error stating that the user’s password was incorrect and ask them to re-enter it. Microsoft believes that the attackers used this technique to ensure that the credentials captured were correct.

Microsoft has provided details on the infrastructure used, which was highly varied and even spanned compromised legitimate domains. Nevertheless, many of the malicious domains which hosted the phishing pages followed a specific regex pattern:

@”^[a-zA-Z]\-[a-zA-Z]{2}\.(xyz|club|shop|online)”

Following the announcement by Microsoft, anti-phishing technologies should implement more effective detections for the phishing emails described by Microsoft, such as the use of open redirection and regex matches for the malicious domain patterns.

These types of advanced phishing attacks are incredibly difficult to spot, so make sure your organisation uses multiple defences against these attacks, such as those described in our blog How to maintain security when employees work remotely.

Sentrium can assist with your security needs, view our penetration testing services for more details or contact us today.

Resources

  • Insights
  • Labs
The importance of a post-penetration test action plan

The importance of a post-penetration test action plan

As cyber threats continue to evolve and become more sophisticated, businesses must stay one step ahead in protecting their sensitive data and network infrastructure. Penetration…

How to choose the right penetration testing partner

How to choose the right penetration testing partner for your business

In today’s digital landscape, cybersecurity threats are evolving at an alarming rate. With the growing number of cyber-attacks and data breaches, businesses must prioritise their…

IoT device security, penetration testing

Securing the Internet of Things: Penetration testing’s role in IoT device security

The world is witnessing a remarkable transformation as more devices become interconnected, forming what’s known as the Internet of Things (IoT). From smart refrigerators and…

Man working as a junior penetration tester

My first month working as a junior penetration tester

Entering the world of cyber security as a junior penetration tester has been an eye-opening experience for me. In my first month, I’ve encountered challenges,…

The role of penetration testing in cybersecurity

The role of penetration testing in cybersecurity

Cybersecurity forms the backbone of safeguarding your business’s data. With cybercrime becoming more sophisticated, traditional security measures are often insufficient. Staying vigilant and proactive is…

IoT Devices

Internet of Things (IoT) Cyber Security

IoT Devices Internet of Things (IoT) cyber security is a growing problem and IoT devices can be found in almost every environment. In 2022 the…

Application Security 101 – HTTP headers

Application Security 101 – HTTP Headers Information Disclosure

Server Header Information Disclosure The most common HTTP header that is enabled by default in most web servers is the ‘Server’ header, which can lead…

SPF, DKIM, DMARC and BIMI for Email Security

SPF, DKIM, DMARC and BIMI for Email Security

Sender Policy Framework Sender Policy Framework (SPF) is a DNS TXT record that is added to a domain that tells email recipients which IP addresses…

Terraform security best practices

Terraform security best practices (2022)

The following sections discuss our most important Terraform security best practices: The importance of Terraform State Terraform must keep track of the resources created. When…

Security vulnerability in Follina exploit

Preventing exploitation of the Follina vulnerability in MSDT

The Follina Exploit A zero-click Remote Code Execution (RCE) vulnerability has started making the rounds which is leveraging functionality within applications such as Microsoft Word.…

Application Security 101 – HTTP headers

Application Security 101 – HTTP headers

1. Strict-Transport-Security The HTTP Strict Transport Security (HSTS) header forces browsers and other agents to interact with web servers over the encrypted HTTPS protocol, which…

Code, HTML, php web programming source code. Abstract code background - 3d rendering

New Exchange RCE vulnerability actively exploited

Exchange admins now have another exploit to deal with despite still reeling from a number of high profile attacks this year including ProxyLogon and ProxyShell.…