SaaS platform exploitation in phishing attacks spikes

guest · Aug 27, 2022

August 24, 2022

BleepingComputer reports that more threat actors have been exploiting software-as-a-service platforms to host credential-stealing phishing campaigns, with phishing URLs on SaaS platforms increasing by more than 1,100% between June 2021 and June 2022.

While SaaS platform abuse has increased across all categories, website builders, collaboration tools, and form builders had the biggest gains, according to a report from Palo Alto Networks Unit 42. Moreover, the exploitation of SaaS platforms began to significantly increase last October amid the growth in form builder abuse.
Click to expand...

Many credential stealing pages have been directly hosted on the exploited SaaS platforms, with attackers sending phishing emails with a URL redirecting to the page, but other landing pages required another redirection step as they did not have the credential-stealing forms, researchers noted. Threat actors have also been leveraging bulletproof service providers to evade takedown requests.

"In the event that the final credential-stealing page is taken down, the attacker can simply change the link and point to a new credential-stealing page, preserving the effectiveness of the original campaign," said the report.
Click to expand...

Palo Alto Networks - Unit42: Legitimate SaaS Platforms Being Used to Host Phishing Attacks

Instead of creating phishing pages from scratch, more and more cybercriminals are now abusing legitimate software-as-a-service (SaaS) platforms, including various website builders or form builders, to host their phishing pages. Since these URLs are hosted on legitimate domains, they can be especially difficult for many phishing detection engines to detect. Furthermore, these platforms typically require little to no coding experience, significantly lowering the barrier to entry for creating and launching phishing attacks.

From the beginning of 2020 to June 2022, Palo Alto Networks analyzed the URLs detected by our Advanced URL Filtering service, and discovered that the number of phishing URLs hosted on legitimate SaaS platforms has continued to increase at an alarming rate. In fact, from June 2021-June 2022, the rate of newly detected phishing URLs hosted on legitimate SaaS platforms has increased over 1100%.
Click to expand...

Log in or Sign up

SaaS platform exploitation in phishing attacks spikes

guest Guest

Log in or Sign up

SaaS platform exploitation in phishing attacks spikes

guest Guest

Useful Searches