Breakdown of an Impersonation Attack: Using IPFS and Personalization to Improve Attack Success

Details from a simple impersonation phishing attack show how well thought out these attacks really are in order to heighten their ability to fool victims and harvest credentials.

Credential harvesting scams are pretty simple at face value: send an email that links to a spoofed login page/website, and let the credentials roll on in.  But advancements in security solutions and their detection capabilities have caused attackers to evolve specific parts of an attack to make them easier to execute, easier to believe, and harder to detect.

According to security researchers at Inky, a new ChatGPT-themed scam has been spotted that uses very specific execution worth noting that revolves around a malicious URL found within a phishing email that asks recipients to verify their email address.  The URL looks similar to the following (which has been modified and is benign):

hxxps://bafybeidqi4sn5nfnfxlgasem4gsdmbq6m55iu6gtouomdgfwu4fx7ps7oq.ipfs[.]dweb[.]link/login.htm#b@inky.com

There are two interesting parts to the URL, according to inky – first the use of “ipfs[.]dweb[.]link”.  The “ipfs” refers to the Interplanetary File System, a decentralized peer-to-peer file sharing network used to store and share data. By using IPFS, websites set up by attackers can’t be easily shutdown (if at all) due to the decentralized nature of the hosting.

Second, is the mention of another domain – “@inky.com” in the example above. The domain used references a spoofed website that should be presented to convince the potential victim they are presenting credentials on a legitimate website. Assuming there are a number of possible sites ready and waiting, attackers only need to change a few characters in a malicious string and they are able to personalize an attack on yet another potential victim company.

These attack details show how attackers are approaching the act of cyber attacks; modular kits with extensible infrastructure to ensure both availability and believability all enhance the attacker’s speed of execution and success rate.

Your defense against such attacks is to educate users on how to respond to any unsolicited email asking for credentials (spoiler, the answer is Don’t provide credentials! – something taught in Security Awareness Training.