Researchers at Menlo Security warn that a phishing campaign is exploiting Google Drawings to evade security filters.
The phishing emails inform the user that their Amazon account has been suspended, instructing them to click on a link in order to update their information and reactivate their account.
The phishing page is crafted with Google Drawings, which makes it more likely to fool humans while evading detection by security technologies.
“This graphic is actually hosted in Google Drawings, part of the Google Workspace suite, that allows users to collaborate on graphics,” the researchers write.
“Such a site is not typically blocked by traditional security tools. Another thing that makes Google Drawings appealing in the beginning of the attack is that it allows users (in this case, the attacker) to include links in their graphics. Such links may easily go unnoticed by users, particularly if they feel a sense of urgency around a potential threat to their Amazon account.”
The attackers are also abusing link shorteners to further increase the chances that the phishing link will bypass security filters.
“We believe that ‘l.wl.co’ was chosen because shortened WhatsApp links created with this service do not present any type of warning to the user that they are being redirected to a different site altogether,” the researchers note. “As an extra precautionary measure, the link created with the WhatsApp URL shortener is then appended with another URL shortener, "qrco[.]de," which is a URL shortener service for dynamic QR codes. We believe that this second step is designed to obfuscate the original link still further, in an effort to evade security URL scanners.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Menlo Security has the story.
Here's how it works:
