New Phishing Campaign Uses Captcha to Bypass Email Gateway

guest · Sep 10, 2019

These Hackers Were Hiding Malware Behind a Captcha
“When checking these against domain reputation databases we receive a false negative and the pages come back as safe.”
September 10, 2019
https://www.cbronline.com/news/captcha-malware-cofense

Hackers are using Captcha methods to bypass automated URL analysis, say security researchers at US-based Cofense, in just the latest creative move by cybercriminals to evade traditional malware detection methods.

The technique lets them fire phishing emails en masse in a manner that bypasses secure email gateways, e.g. that of Mimecast.
If someone clicks the link to hear the voice message they are then redirected to a website which immediately asks you to do a Captcha verification test. Upon passing this the user will be asked to select a Microsoft account and login. All data input into this login page is captured by the hacker.

The clever part of this hack is that the Captcha verification test is conducted on a different webpage: hitting the Captcha button is the redirect to the webpage containing the malware. This layering of a clean page on top of an infected login page is where normal security scans are bypassed.
Click to expand...

Bypassing Secure Email Gateway
When a secure email gateway (SEG) scanned the website link contained in the voicemail it could only scan as far as the Captcha website, which got a clean bill of health. This effectively blocks the SEG from doing its job through the use of a layered webpage.
Click to expand...

Cofense: New Phishing Campaign Uses Captcha to Bypass Email Gateway

Log in or Sign up

New Phishing Campaign Uses Captcha to Bypass Email Gateway

guest Guest

Log in or Sign up

New Phishing Campaign Uses Captcha to Bypass Email Gateway

guest Guest

Useful Searches