threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Back to summary

URL:
https://threatpost.com/malformed-url-prefix-phishing-attacks-spike-6000/164132/
Submission: On October 18 via manual (October 18th 2022, 1:27:31 am UTC) from US — Scanned from DE

Form analysis
2 forms found in the DOM

GET https://threatpost.com/

<form class="c-site-search__form" role="search" method="get" action="https://threatpost.com/">
  <input type="text" class="c-site-search__field" name="s" placeholder="Search">
  <button type="submit" class="c-button c-button--secondary c-button--smaller c-site-search__button" value="Search"><svg class="icon fill">
      <use xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg#icon-search"></use>
    </svg> Search</button>
  <div class="c-site-search__overlay"></div>
</form>

GET https://threatpost.com/

<form class="c-site-search__form" role="search" method="get" action="https://threatpost.com/">
  <input type="text" class="c-site-search__field" name="s" placeholder="Search">
  <button type="submit" class="c-button c-button--secondary c-button--smaller c-site-search__button" value="Search"><svg class="icon fill">
      <use xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg#icon-search"></use>
    </svg> Search</button>
  <div class="c-site-search__overlay"></div>
</form>

Text Content

Threatpost
* Podcasts
* Malware
* Vulnerabilities
* InfoSec Insiders
* Webinars

*
*
*
*
*
*
*

* Mysterious Silver Sparrow Malware Found Nesting on 30K MacsPrevious article
* Accellion FTA Zero-Day Attacks Show Ties to Clop Ransomware, FIN11Next
article

MALFORMED URL PREFIX PHISHING ATTACKS SPIKE 6,000%

Author: Becky Bracken
February 19, 2021 4:06 pm
3 minute read

Share this article:

*
*

Sneaky attackers are flipping backslashes in phishing email URLs to evade
protections, researchers said.

Researchers from GreatHorn report they have observed a nearly 6,000-percent jump
in attacks using “malformed URL prefixes” to evade protections and deliver
phishing emails that look legit. They look legit, that is, unless you look
closely at the symbols used in the prefix before the URL.

“The URLs are malformed, not utilizing the normal URL protocols, such as http://
or https://,” researchers

Click to Register

said in a blog post about their findings. “Instead, they use http:/\ in their
URL prefix.”

The slashes in the address are largely superfluous, the GreatHorn report
explained, so browsers and many scanners don’t even look at them.

Typosquatting is a common phishing email tactic where everyday business names
are mispelled, like “amozon.com” — to try and trick unobservant users into
clicking. But these days, researchers explained, most people know to look for
these kinds of email scams, so threat actors have had to evolve too.

EMAIL PROTECTIONS IGNORE BACKSLASHES IN URL PREFIX

“The URLs don’t fit the ‘known bad’ profiles developed by simple email scanning
programs, allowing them to slip through undetected,” researchers said. “They may
also slip past human eyes that aren’t accustomed to looking in the prefix for
signs of suspicious activity.”

The researchers reported they first noticed this new tactic last October, and
said that it has been quickly gaining momentum ever since — with attacks between
January and early February spiking by 5,933 percent, they said.

WHAT DOES A MALFORMED URL ATTACK LOOK LIKE?

GreatHorn provided an example of a malformed URL phishing email with the
address:
“http:/\brent.johnson.australiasnationalskincheckday.org.au//exr/brent.johnson@impacteddomain.com”

The phishing email appears to be sent from a voicemail service; the researchers
explained. The email contains a link to play the voice message “Play Audi
Date.wav” which redirects to a malicious site, the team reported.

A phishing page with a ReCAPTCHA. Source: GreatHorn.

“The website even includes a reCAPTCHA, a common security feature of legitimate
websites, showing the sophistication and subtlety of the attempted attack,” they
explained.

The next page looks like an Office login page and asks for a username and
password, the report said. Once entered, the attackers have control of the
account credentials.

Office 365 users were far more likely to experience this type of breach, the
report added, at a “much higher rate than organizations running Google Workspace
as their cloud email environment.”

A fake Microsoft sign-in page. Source: GreatHorn.

The attackers using these malformed URLs have engaged in a variety of tactics to
deliver their malware, including using a spoofed display name to impersonate the
user’s company internal email system; avoiding scanners searching for “known
bad” domains by sending from an address with no established relationship with
the business; embedding a link in phishing emails which opens a redirector
domain; and using language to give the user a sense of “urgency” in the message,
the report explained.

The report recommended “that security teams search their organizational email
for messages containing URLs that match the threat pattern (http:/\) and remove
any matches,” to keep their systems protected.

An example of an email with an “audio message” alert. Source: GreatHorn.

Kevin O’Brien, CEO and co-founder of GreatHorn, told Threatpost that these
malformed URL attacks could be mitigated through third-party solutions able to
perform more nuanced analysis.

“There are a variety of API-native solutions that have come into the market in
the last five years,” O’Brien said. “Many of these solutions are designed to
specifically address the kinds of threats that both legacy secure email gateways
and platforms are incapable of analyzing or identifying, providing robust
remediation options, and highlighting to users when they’re about to go
somewhere they don’t need to go to, such as what we saw in this attack.”

EMAIL PHISHING SCAMS MORE COMMON, MORE EXPENSIVE

The report drops amid a particularly lucrative period for phishing scams.
Proofpoint’s recent 2020 State of the Phish showed a 14 percent jump in U.S.
phishing attacks over the past year.

“Threat actors worldwide are continuing to target people with agile, relevant
and sophisticated communications—most notably through the email channel, which
remains the top threat vector,” Alan LeFort, senior vice president and general
manager of Security Awareness Training for Proofpoint said. “Ensuring users
understand how to spot and report attempted cyberattacks is undeniably
business-critical, especially as users continue to work remotely — often in a
less secured environment. While many organizations say they are delivering
security awareness training to their employees, our data shows most are not
doing enough.”

IS YOUR SMALL- TO MEDIUM-SIZED BUSINESS AN EASY MARK FOR ATTACKERS?

Threatpost WEBINAR: Save your spot for “15 Cybersecurity Gaffes SMBs Make,”
a FREE Threatpost webinar on Feb. 24 at 2 p.m. ET. Cybercriminals count on you
making these mistakes, but our experts will help you lock down your small- to
mid-sized business like it was a Fortune 100. Register NOW for this LIVE webinar
on Wed., Feb. 24.

Share this article:

* Most Recent ThreatLists
* Web Security

threatpost.com Open in urlscan Pro 35.173.160.135 Public Scan

Form analysis 2 forms found in the DOM

GET https://threatpost.com/

GET https://threatpost.com/

Text Content

threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Form analysis
2 forms found in the DOM