Latest Phishing Scam Uses Cross-Site Scripting Attack to Harvest Personal Details
Cross-Site Scripting (XSS) is alive and well, and used in attacks to obfuscate malicious links in phishing emails to redirect users to threat-actor controlled websites.
We saw earlier this year that phishing attacks leveraging XSS were on the rise. Now, new scams are using XSS to hide their malicious intent within emails, according to new analysis from cybersecurity vendor INKY.
These attacks usually begin with an email stating the victim has won something, as shown below:
Source: INKY
The URL associated with the “Get Started Now” link is actually a simple benign link to a website with a query of “q=” and a long string of characters – which is encoded JavaScript code designed to inject a script into the web page to redirect the browser to a new threat actor-controlled location.
This relatively simple scam is easy to identify, as brands like Marriott, Harbor Freight, Lowes and Costo (brands impersonated in this scam) aren’t in the business of giving things away.
Users that have undergone new-school security awareness training are keenly aware of the fact that “when it looks too good to be true, it is”, and will simply delete the email before enabling any of its’ malicious functionality.
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW