Glitch service abused to host short-lived phishing sites

guest · Nov 18, 2021

Glitch service abused to host short-lived phishing sites
November 18, 2021
https://www.bleepingcomputer.com/ne...ce-abused-to-host-short-lived-phishing-sites/

Phishing actors are now actively abusing the Glitch platform to host short-lived credential-stealing URLs for free while evading detection and takedowns.

The recent campaigns are targeting employees at major corporations who work with the Middle East.
Based on an analysis by the DomainTools research team, this phishing campaign started in July 2021 and is still ongoing.
Click to expand...

"Clean" PDFs that evade detection
The actors send emails with PDF document attachments that do not contain any malicious code, so no antivirus alerts are generated.

Instead, these PDFs contain a link that directs the user to a page hosted at Glitch, which would display a landing page.
DomainTools sourced 70 PDFs of this type and found that they all used a unique email and URL to link to various Glitch-hosted "red.htm" pages.
Click to expand...

Abusing Glitch
Glitch is a cloud hosting service that allows people to deploy apps and websites using Node.js, React, and other development platforms.

This platform is enticing for phishing attacks because they offer a free version that lets users create an app/page and keep it live on the web for five minutes. After that, the user has to enable it again manually.
Click to expand...

After pulling these pages, the researchers found chunks of obfuscated JavaScript used for exfiltrating credentials to an email address after passing them through compromised WordPress sites.
The threat actors hosted these documents on various services similar to Glitch, such as Heroku, or through content distribution networks like SelCDN.

This means that Glitch was only one of the many channels the phishing actors abused to evade detection and steal credentials.
Click to expand...

DomainTools: Seeing Red

Further analysis concluded that no document was ever delivered or at least that DomainTools Research could not get the sites to deliver one, making this seemingly a credential harvesting spear phishing campaign aimed at large companies with dealings in the Middle East based upon the targets found in documents.

Spaces where code can run and be hosted for free are a gold mine for attackers, especially considering many of the base domains are implicitly trusted by the blocklists corporations ingest.
Click to expand...

Log in or Sign up

Glitch service abused to host short-lived phishing sites

guest Guest

Log in or Sign up

Glitch service abused to host short-lived phishing sites

guest Guest

Useful Searches