Threat actors leveraging Open Redirect Vulnerabilities to Deliver Phishing Content

guest · Aug 11, 2022

August 10, 2022

Researchers at Resecurity noticed threat actors leveraging Open Redirect Vulnerabilities which is popular in online services and apps to evade spam filters to deliver phishing content. Trusted service domains like Snapchat and other online services make special URLs that lead to malicious resources with phishing kits.

The kit identified is named ‘LogoKit’ that was earlier used in attacks against Office 365, Bank of America, GoDaddy, Virgin Fly, and other financial institutions and online services.
Click to expand...

LogoKit – Phishing Kit
LogoKit is well-known for its dynamic content generation using JavaScript. It can change logos of the impersonated service and text on the landing pages in to adapt on the fly. Therefore, the targeted victims will possibly interact with the malicious resource.

The analysis says in November 2021, there were more than 700 identified domain names used in campaigns leveraging LogoKit and it goes on to increase.
Click to expand...

The threat actors without the need for changing templates, the LogoKit script itself will assist to embed malicious scripts or host attacker infrastructure.

“Unfortunately, the use of Open Redirect vulnerabilities significantly facilitates LogoKit distribution, as many (even popular) online-services don’t treat such bugs as critical, and in some cases – don’t even patch, leaving the open door for such abuse”, Resecurity
Click to expand...

Resecurity: LogoKit Update – The Phishing Kit Leveraging Open Redirect Vulnerabilities

Using highly trusted service domains like Snapchat and other online-services, they create special URLs which lead to malicious resources with phishing kits. The kit identified is named LogoKit, which was previously used in attacks against the customers of Office 365, Bank of America, GoDaddy, Virgin Fly, and many other major financial institutions and online-services internationally.

The spike of LogoKit was been identified around the beginning of August, when multiple new domain names impersonating popular services had been registered and leveraged together with Open Redirects. While LogoKit is known for a while in the underground, at least since 2015, the cybercrime group behind it is constantly leveraging new tactics.
Click to expand...

guest · Jan 9, 2023

Fake OnlyFans dating sites abuse UK Environment Agency open redirect
By Bill Toulas @billtoulas - January 9, 2023

Threat actors abused an open redirect on the official website of the United Kingdom's Department for Environment, Food & Rural Affairs (DEFRA) to direct visitors to fake OnlyFans adult dating sites.
Click to expand...

OnlyFans is a content subscription service where paid subscribers get access to private photos, videos, and posts from adult models, celebrities, and social media personalities.

As it is a widely used site, and the name is recognizable, threat actors have created a series of fake OnlyFans adult dating sites to gain subscribers or steal people's personal information.
Abusing open redirect on DEFRA
As part of this malicious campaign, threat actors abused an open redirect at that looked like a legitimate U.K. government link but redirected visitors to the fake OnlyFans dating site.
Redirects are legitimate URLs on website web addresses that automatically redirect users from the initial site to another URL, commonly at an external site.
Click to expand...

An open redirect can be modified by anyone, allowing threat actors and scammers to create redirects from a legitimate site to any site they want.

This allows threat actors to abuse open redirects and cause legitimate links to appear in search results that send visitors to websites under their control to display phishing forms or deliver malware.
Click to expand...

The malicious campaign abusing the open redirect on DEFRA's river conditions site was discovered last week by analysts at Pen Test Partners, who shared their findings with BleepingComputer.

"On Tuesday afternoon, one of my colleagues Adam Bromiley noticed an open redirect on the UK’s Environment Agency web site. It popped up during a Google search whilst he was looking for SoC (hardware System on Chip) datasheets!," explained the report by Pen Test Partners.
The abuse of government open redirect sites to push adult phishing sites is not new.
Click to expand...

Log in or Sign up

Threat actors leveraging Open Redirect Vulnerabilities to Deliver Phishing Content

guest Guest

guest Guest

Log in or Sign up

Threat actors leveraging Open Redirect Vulnerabilities to Deliver Phishing Content

guest Guest

guest Guest

Useful Searches