Phishing Attacks Continue to Leverage URL Shorteners to Obfuscate Malicious Links
Analysis of current phishing attacks by security researchers have uncovered an increase in the use of trusted shortlink services.
To be successful, phishing scammers need to establish legitimacy as much and as early as possible.
Brand impersonation within an email has long been one method, but to establish legitimacy to security solutions, scammers have had to do more than just have a look-alike domain.
According to security researchers at Barracuda, a wave of phishing attacks is leveraging legitimate URL shortening services to add a layer of obfuscation to their malicious links in emails.
While some security solutions actually follow links to – and analyze – their final destination, many solutions simply look at the link itself. By using a shortlink – like those created by bit.ly that look similar to “bit[dot]ly[slash]FakeURL”, solutions that take the link at face value will see it as legitimate.
Barracuda theorizes that threat actors are compromising credentials at these shortlink services to gain access and utilize them as part of phishing attacks.
There’s really only two ways to counteract this:
- Employ security solutions that traverse links and scan final web destinations for malicious content
- Teach users through continual new-school security awareness training to be vigilant each and every time they interact with an email, at attachment, or a web link, not trusting the content or context in front of them and choosing to scrutinize before proceeding.
And because cybercriminals will continue to evolve their methods, both of the ways mentioned should be put in place.
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW