New Evasive Phishing Techniques Help Cybercriminals Launch “Untraceable” Campaigns
Scary new details emerge of cybercriminals using reverse tunneling and URL shorteners to evade detection by security solutions, allowing them to take victims for their credentials and more.
We expect that as threat actors change their techniques, security solutions will keep up and detect attacks as they occur and before they can do any damage. But a new report from security vendor CloudSEK highlights a new campaign that allows the threat actors to host malicious webpages on their own local computers using a mix of reverse tunneling technology and URL shorteners.
According to the report, the use of reverse tunnel services allows threat actors to generate random URLs that avoid detection as being malicious, further obfuscating the URLs by running them through URL shorteners like Bit.ly, is.gd, and cutt.ly.
While these techniques aren’t necessarily new, the report does note that there is an increase in frequency and sophistication to these attacks, making them far more likely to be successful.
But in the end, the real success behind these phishing attacks – even those that use these advanced evasion techniques – is whether the recipient falls for the social engineering found in the email content and the malicious landing page hosted by the threat actor.
Users that are continually kept updated with Security Awareness Training are far more likely to see these scams for what they really are and far less likely to fall victim to such attacks.
This report makes it clear that threat actors are working to find ingenious ways to keep security solutions from detecting an attack, making it more imperative for organizations to empower users through continual training to play a role in stopping attacks.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW