Microsoft Warns About a Widespread Phishing Campaign Which Abuses Redirector Links

  • Microsoft has uncovered a large-scale credentials phishing campaign that relies upon hundreds of domains.
  • The actors are using redirections, CAPTCHA verifications, and fake error messages to convince the victim and trick security systems.
  • The phishing pages where the victims land can be highly customized even featuring their employer’s logos.

Microsoft has uncovered a new large-scale credential phishing campaign that abuses redirector links while also impersonating well-known productivity tools and services and engaging in social engineering. As the tech giant explains, redirections in email communications are very common as organizations try to get their customers to landing pages, track their click rates, and log metrics.

Phishing actors like to abuse these redirections as they can help them take users to a malicious website after bouncing them around on “clean” sites, tricking both the recipients and potentially any internet security tools they rely upon.

Source: Microsoft

To further strengthen their campaign, the particular actors use a wide selection of domains from multiple countries, compromised websites, and attacker-owned DGA domains. This creates a pluralism that makes the infrastructure difficult to map and flag, so the actors continue delivering messages without many blocking problems. Microsoft says they have confirmed at least 350 unique phishing domains used in this campaign, but these are likely only a part of the total scale of the infrastructure.

The goal of the actors is to steal credentials from their victims and then use them to infiltrate corporate networks. The general pattern followed in this campaign is to embed a large login box on the message body, urging the recipient to click on it on a fake pretense. Sometimes it is to receive an important file through a cloud service - other times, it is to address a password expiration problem, and in some cases, it is to view a Zoom invitation.

Source: Microsoft

The redirection that takes place after clicking on the button typically includes a reCAPTCHA step, which acts as a wall for dynamic scanning systems that could perform in-depth analysis, as well as an element of legitimacy for the victim. If the user completes the verification, they are taken to the actual phishing page, where they are asked to enter their password. Notably, the actors deliver highly customized pages at this step by using PHP parameters, sometimes even including company logos to match the victim’s employer.

Source: Microsoft

Once the victim enters their credentials, they get an error message about the session being timed out or an incorrect password. Possibly, forcing the victim to enter the password twice is a way to ensure that the stolen pass is indeed valid, as making typing errors isn’t that unusual. Entering the password again takes the victim to a final redirection on a Sophos website that tells them the message has been released, ensuring that the victim won’t get suspicious that anything bad had happened.

Latest
ICC World Test Championship Final 2023 Live Stream: How to Watch Test Cricket Online from Anywhere 
The pinnacle of test cricket is upon us, and the excitement is high ahead of what promises to be a thrilling contest...
How to Watch Avatar: The Way of Water Online from Anywhere
This year, Avatar: The Way Of Water became the third-highest-grossing picture of all time, collecting more than 2 billion dollars since its...
How to Watch It’s Always Sunny in Philadelphia Season 16 Online from Anywhere
It’s Always Sunny in Philadelphia Season 16 is here, and you will find below the premiere date, cast, plot, episode release schedule,...
For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: Chrome, Edge, Firefox, Safari