Phishing campaign exploits Symantec URL Protection to cover its tracks

guest · May 14, 2020

Phishing campaign exploits Symantec URL Protection to cover its tracks
The email also claims to have been scanned by Symantec email security
May 14, 2020
https://www.techrepublic.com/articl...-symantec-url-protection-to-cover-its-tracks/

Spammers and scammers typically try to obfuscate and legitimize their malicious content in an effort to better trick people.
A new phishing attack analyzed by Armorblox takes advantage of Symantec to trick users into falling for the scam. In a blog post published Thursday titled "Credential Theft Using Symantec URL Rewriting," Armorblox describes how this campaign operates.

Sent to an employee who works with real estate, the phishing email contained a link to a PDF that purportedly included bid details for an upcoming building project. Clicking on the link redirects the recipient through several pages, ending with one asking for login details. Designed to resemble Microsoft OneDrive and Adobe pages, the login page asks recipients to enter their account credentials, which are then captured by the attacker.

Beyond the use of Symantec, the attacker created a new domain for the final phishing site, allowing it to get through Microsoft's Exchange Online Protection filters. As the login pages look like legitimate Microsoft and Adobe pages, users might enter their credentials for either type of account.
Click to expand...

Armorblox: Blox Tales #5: Credential Theft Using Symantec URL Rewriting

Log in or Sign up

Phishing campaign exploits Symantec URL Protection to cover its tracks

guest Guest

Log in or Sign up

Phishing campaign exploits Symantec URL Protection to cover its tracks

guest Guest

Useful Searches