Attackers Abuse URL Rewriting to Evade Security Filters
Attackers continue to exploit URL rewriting to hide their phishing links from email security filters, according to researchers at Abnormal Security.
URL rewriting is a security technique used by many email security platforms to analyze links in emails to verify their safety before users are allowed to click on them. However, this technique can also be abused to mask the original phishing link.
“In the first step of the attack, the threat actor compromises an email account belonging to a customer of an email security solution that leverages URL rewriting (not the target of the actual email attack presented hereafter),” the researchers write.
“The threat actor then sends an email to that same compromised account containing a novel URL, which will get rewritten rather than blocked. When the threat actor has that rewritten URL, a new email is sent from the compromised account to the threat actor’s next victims containing that rewritten URL.”
This new email impersonates a Microsoft security alert informing the user that a malicious link was blocked. The email contains a link to view details about the alert.
“Because this message originates from a legitimate account, passes email authentication, and contains a novel, rewritten URL from a legitimate security control, the victim’s secure email gateway (SEG) delivers the message and rewrites the already-rewritten URL,” Abnormal says.
If the user clicks the link, they’ll be sent to a site that attempts to trick them into installing an OAuth app that gives the attacker access to their Microsoft 365 account.
“[T]he user is redirected to another site and must solve a CAPTCHA. After this, they are prompted to allow the installation of an OAuth application,” the researchers write. “This grants the attacker permission to access their M365 account. Instead of a traditional phishing attack, the user unknowingly installs an add-on that gives the attacker ongoing access to the account, even if the user changes their password. The only way to stop this access is by removing the add-on from the account.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Abnormal Security has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW