Open Redirect Flaw Snags Amex (American Express), Snapchat User Data

guest · Aug 6, 2022

Separate phishing campaigns targeting thousands of victims impersonate FedEx and Microsoft, among others, to trick victims.
August 5, 2022

Attackers are exploiting a well-known open redirect flaw to phish people’s credentials and personally identifiable information (PII) using American Express and Snapchat domains, researchers have found.

Threat actors impersonated Microsoft and FedEx among other brands in two different campaigns, which researchers from INKY observed from mid-May through late July, they said in a blog post published online. Attackers took advantage of redirect vulnerabilities affecting American Express and Snapchat domains, the former of which eventually was patched while the latter still is not, researchers said.
Click to expand...

Open redirect is a security vulnerability that occurs when a website fails to validate user input, which allows bad actors to manipulate the URLs of domains from legitimate entities with good reputations to redirect victims to malicious sites, researchers said. The vulnerability is well known and tracked as CWE-601: URL Redirection to Untrusted Site (‘Open Redirect’).

“Since the first domain name in the manipulated link is in fact the original site’s, the link may appear safe to the casual observer,” INKY’s Roger Kay explained in the post.
Click to expand...

The two campaigns also both used exploits in which attackers inserted PII in the seemingly legitimate URL so that the malicious landing pages could be customized on the fly for the individual victims, they said.

The phishing emails in the Snapchat open redirect group impersonated DocuSign, FedEx and Microsoft, and all had snapchat open redirects that led to Microsoft credential harvesting sites, researchers said.
The open redirect bug on the American Express domain also appeared unpatched at first, he said.

“Now, users who click the link end up on a real American Express error page,” he wrote.
Click to expand...

INKY: Phishers Bounce Lures Off Unprotected Snapchat, Amex Sites

Within redirection is the concept of the “open redirect,” wherein a site basically lets any random user specify a redirect URL at will and the site allows the transfer of traffic.

In these instances, reputable (but unprotected) sites — specifically, American Express and Snapchat — were abused to send traffic to credential harvesting sites.
Click to expand...

Log in or Sign up

Open Redirect Flaw Snags Amex (American Express), Snapchat User Data

guest Guest

Log in or Sign up

Open Redirect Flaw Snags Amex (American Express), Snapchat User Data

guest Guest

Useful Searches