securityaffairs.com Open in urlscan Pro
2606:4700:3031::ac43:8cd3  Public Scan

Form analysis
1 forms found in the DOM

Name: searchform — GET https://securityaffairs.com/

<form role="search" method="get" name="searchform" id="searchform" action="https://securityaffairs.com/">
  <div>
    <input type="text" value="" name="s" id="s" autocomplete="off" title="Search..." class="blur">
    <button type="submit">
      <i class="fa fa-search"></i>
    </button>
  </div>
  <div id="autocomplete"></div>
</form>

Text Content

WE VALUE YOUR PRIVACY

We and our partners store and/or access information on a device, such as cookies
and process personal data, such as unique identifiers and standard information
sent by a device for personalised ads and content, ad and content measurement,
and audience insights, as well as to develop and improve products.

With your permission we and our partners may use precise geolocation data and
identification through device scanning. You may click to consent to our and our
partners’ processing as described above. Alternatively you may access more
detailed information and change your preferences before consenting or to refuse
consenting. Please note that some processing of your personal data may not
require your consent, but you have a right to object to such processing. Your
preferences will apply to this website only. You can change your preferences at
any time by returning to this site or visit our privacy policy.

MORE OPTIONSAGREE

Ad


 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me


MUST READ

Headlines
 * Beware of the new phishing technique "file archiver in the browser" that
   exploits zip domains
 * BrutePrint Attack allows to unlock smartphones with brute-forcing fingerprint
 * Lockbit ransomware attack on MCNA Dental impacts 8.9M individuals
 * New Go-written GobRAT RAT targets Linux Routers in Japan
 * Researchers analyzed the PREDATOR spyware and its loader Alien
 * Attackers use encrypted RPMSG messages in Microsoft 365 targeted phishing
   attacks



Ad


 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me


BEWARE OF THE NEW PHISHING TECHNIQUE “FILE ARCHIVER IN THE BROWSER” THAT
EXPLOITS ZIP DOMAINS

May 30, 2023  By Pierluigi Paganini




“FILE ARCHIVER IN THE BROWSER” IS A NEW PHISHING TECHNIQUE THAT CAN BE EXPLOITED
BY PHISHERS WHEN VICTIMS VISIT A .ZIP DOMAIN.

A new phishing technique called “file archiver in the browser” can be used by
phishers to “emulate” a file archiver software in a web browser when a victim
visits a .ZIP domain. The security researcher mr.d0x detailed the new attack
technique.

In May 2023, Google launched eight new top-level domains (TLDs) that included
.zip and .mov. Security experts are warning of malicious uses of these domains.


00:00/00:00


To carry out an attack using this technique, the attacker needs to emulate a
file archive software through HTML/CSS. The researchers shared two samples, the
first one emulates the WinRAR file archive utility, the second one the Windows
11 File Explorer window.

The researchers employed a clever trick, as depicted in the image below, where
they added a ‘Scan’ icon to the WinRAR sample. When users click on the icon, a
message box reassuring them that the files are secure is displayed, thereby
preventing suspicion.

Then the researchers deployed the sample on a .zip domain that can be used for
multiple attack scenarios such as:

 * redirect the visitors to a landing page created to steal the victim’s
   credentials when a file is clicked.
 * deceive the visitors by presenting an executable file with a disguised
   extension. When users click on what appears to be a .pdf file (for example,
   “invoice.pdf”), it actually downloads an executable file

The researcher noted that numerous Twitter users emphasized the Windows File
Explorer search bar as an effective delivery method.

“Several people pointed out on Twitter that the Windows File Explorer search bar
is a good delivery vector. If the user searches for mrd0x.zip and it doesn’t
exist on the machine, it will automatically open it up in the browser. This is
perfect for this scenario since the user would be expecting to see a ZIP file.”
reads the analysis published by mr.d0x.

The recently launched TLDs provide attackers with more opportunities for
phishing campaigns. The knowledge of this attack technique is essential to avoid
beign victims of these attack.

It is strongly advised for organizations to implement blocking measures for .zip
and .mov domains, as they are currently being exploited by phishers and are
expected to see a further rise in their malicious usage.

“It’s highly recommended for organizations to block .zip and .mov domains as
they are already being used for phishing and will likely only continue to be
increasingly used.” concludes the expert.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, phishing)


SHARE THIS:

 * Email
 * Twitter
 * Print
 * LinkedIn
 * Facebook
 * More
 * 

 * Tumblr
 * Pocket
 * 


.zip domainCybercrimefile archiver in the browserHackinghacking newsinformation
security newsIT Information SecurityphishingPierluigi PaganiniSecurity
AffairsSecurity News


--------------------------------------------------------------------------------

SHARE ON

 * 
 * 
 * 
 * 
 * 
 * 
 * 


PIERLUIGI PAGANINI

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and
Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he
is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security
expert with over 20 years experience in the field, he is Certified Ethical
Hacker at EC Council in London. The passion for writing and a strong belief that
security is founded on sharing and awareness led Pierluigi to find the security
blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some
major publications in the field such as Cyber War Zone, ICTTF, Infosec Island,
Infosec Institute, The Hacker News Magazine and for many other Security
magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency
and Bitcoin”.




--------------------------------------------------------------------------------

PREVIOUS ARTICLE

BrutePrint Attack allows to unlock smartphones with brute-forcing fingerprint


--------------------------------------------------------------------------------





YOU MIGHT ALSO LIKE


BRUTEPRINT ATTACK ALLOWS TO UNLOCK SMARTPHONES WITH BRUTE-FORCING FINGERPRINT

May 30, 2023  By Pierluigi Paganini

LOCKBIT RANSOMWARE ATTACK ON MCNA DENTAL IMPACTS 8.9M INDIVIDUALS

May 29, 2023  By Pierluigi Paganini





 * Ad


 * DIGGING THE DEEP WEB: EXPLORING THE DARK SIDE OF THE WEB


 * CENTER FOR CYBER SECURITY AND INTERNATIONAL RELATIONS STUDIES

 * Ad


 * SUBSCRIBE SECURITY AFFAIRS NEWSLETTER


 * SECURITYAFFAIRS AWARDED AS BEST EUROPEAN CYBERSECURITY TECH BLOG AT EUROPEAN
   CYBERSECURITY BLOGGER AWARDS




More Story

BRUTEPRINT ATTACK ALLOWS TO UNLOCK SMARTPHONES WITH BRUTE-FORCING FINGERPRINT

Researchers devised an attack technique, dubbed BrutePrint Attack, that allows
brute-forcing fingerprints on smartphones...
Copyright 2021 Security Affairs by Pierluigi Paganini All Right Reserved.
Back to top
 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me

We use cookies on our website to give you the most relevant experience by
remembering your preferences and repeat visits. By clicking “Accept All”, you
consent to the use of ALL the cookies. However, you may visit "Cookie Settings"
to provide a controlled consent.
Cookie SettingsAccept All
Manage consent
Close

PRIVACY OVERVIEW

This website uses cookies to improve your experience while you navigate through
the website. Out of these cookies, the cookies that are categorized as necessary
are stored on your browser as they are essential for the working of basic
functionalities...
Necessary
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly.
This category only includes cookies that ensures basic functionalities and
security features of the website. These cookies do not store any personal
information.
Non-necessary
Non-necessary
Any cookies that may not be particularly necessary for the website to function
and is used specifically to collect user personal data via analytics, ads, other
embedded contents are termed as non-necessary cookies. It is mandatory to
procure user consent prior to running these cookies on your website.
SAVE & ACCEPT


Go to mobile version