“Third-party phishing sites…will include some characteristics of the original flow, with an added step – the initial impersonation that establishes credibility to the end user is a service that is not connected to the targeted organization,” the researchers write. “Furthermore, the third-party phishing page itself won’t ask the victim to submit their personal credentials. The fraud occurs in the final phishing page to which the client has been redirected, impersonating the chosen financial institution.”
BlueVoyant has seen a significant spike in this technique over the past year.
“Third-party phishing websites are spread on a massive scale across the internet,” the researchers write. “Over the past year, BlueVoyant has witnessed a major increase in the number of phishing sites originating in third-party phishing campaigns. One major European client saw an increase from just 2% of all detected phishing attacks in 2022 to 21% in 2023... It now permeates across a number of sectors: e-commerce, logistics and shipping, mobile carriers, government institutions, payment transaction platforms, and more.”
The use of intermediate sites helps the attackers avoid detection by security tools.
“Third-party phishing adds a new wrinkle to the oldest trick in the book,” the researchers write. “Intermediary sites directing victims to various different phishing sites provides two benefits to attackers: it allows them to cast a wider net and catch more fish (so to speak), and it provides another degree between them and threat hunters who may be on their trail. We’ve previously published research highlighting how attackers use redirects as an evasion mechanism – third-party phishing builds on that concept, while also giving the threat actor a greater chance of ensnaring their targets.”
New-school security awareness training can help your employees stay ahead of evolving social engineering tactics.