Phishing Campaign Exploits Nespresso Domain
Attackers are launching phishing campaigns using an open-redirect vulnerability affecting a website belonging to coffee machine company Nespresso, according to researchers at Perception Point.
Open-redirect vulnerabilities enable attackers to send users to phishing sites via seemingly benign links. In this case, the attackers are sending emails that appear to be multi-factor authentication requests from Microsoft.
“This attack starts with an email,” the researchers explain. “Albeit, in this instance a very strange email that at first glance appears to be a multi-factor authentication request from Microsoft. The email sender is unaffiliated with Microsoft. At the bottom of the message it seems that the email has been forwarded twice. This creates a rather muddled message that the attacker likely fabricated entirely. Perhaps the intent of the ‘forwarding’ was to provide an explanation as to why the email doesn’t originate from Microsoft. Regardless of the convoluted details, the overall message is clear.”
If the user clicks the link, they’ll be sent to a phony Microsoft login page designed to steal their credentials.
“The email urges the recipient to check their recent login activity,” the researchers write. “Upon clicking the link, the user is first directed to the infected Nespresso URL, followed by a redirection to an .html file. The goal of using the Nespresso open redirect vulnerability is to evade security measures. Attackers know that some security vendors only inspect the initial link, not digging further to discover any hidden or embedded links. With this knowledge, it makes sense that the attacker would host the redirect on Nespresso, as the legitimate domain would likely be sufficient to bypass many security vendors, detecting only the reputable URL and not the subsequent malicious ones.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Perception Point has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW