Attackers Abuse URL Rewriting to Evade Security Filters

Attackers continue to exploit URL rewriting to hide their phishing links from email security filters, according to researchers at Abnormal Security.

URL rewriting is a security technique used by many email security platforms to analyze links in emails to verify their safety before users are allowed to click on them. However, this technique can also be abused to mask the original phishing link.

“In the first step of the attack, the threat actor compromises an email account belonging to a customer of an email security solution that leverages URL rewriting (not the target of the actual email attack presented hereafter),” the researchers write.

“The threat actor then sends an email to that same compromised account containing a novel URL, which will get rewritten rather than blocked. When the threat actor has that rewritten URL, a new email is sent from the compromised account to the threat actor’s next victims containing that rewritten URL.”

This new email impersonates a Microsoft security alert informing the user that a malicious link was blocked. The email contains a link to view details about the alert.

“Because this message originates from a legitimate account, passes email authentication, and contains a novel, rewritten URL from a legitimate security control, the victim’s secure email gateway (SEG) delivers the message and rewrites the already-rewritten URL,” Abnormal says.

If the user clicks the link, they’ll be sent to a site that attempts to trick them into installing an OAuth app that gives the attacker access to their Microsoft 365 account.

“[T]he user is redirected to another site and must solve a CAPTCHA. After this, they are prompted to allow the installation of an OAuth application,” the researchers write. “This grants the attacker permission to access their M365 account. Instead of a traditional phishing attack, the user unknowingly installs an add-on that gives the attacker ongoing access to the account, even if the user changes their password. The only way to stop this access is by removing the add-on from the account.”

KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

Abnormal Security has the story.