Threat actors are abusing cloud storage platforms to host phishing sites that can more easily evade detection by security scanners, according to researchers at Enea.
Criminals are exploiting numerous cloud services, including Google Cloud, AWS, IBM Cloud, and others.
“Cybercriminals have now found a way to exploit the facility provided by cloud storage to host static websites (typically .html files) containing embedded spam URLs in their source code,” the researchers explain. “The URL linking to the cloud storage is distributed via text messages, which appear to be authentic and can therefore bypass firewall restrictions.
When mobile users click on these links, which contain well-known cloud platform domains, they are directed to the static website stored in the storage bucket. This website then automatically forwards or redirects users to the embedded spam URLs or dynamically generated URLs using JavaScript, all without the user’s awareness.”
Threat actors are always looking for new ways to bypass technical defenses in order to target employees directly. Security awareness training can provide an essential layer of defense against social engineering attacks.
“Since the main domain of the URL contains, for example, the genuine Google Cloud Storage URL/domain, it is challenging to catch it through normal URL scanning,” Enea says. “Detecting and blocking URLs of this nature presents an ongoing challenge due to their association with legitimate domains belonging to reputable or prominent companies.
Additional considerations of various factors and behaviors are necessary to effectively address this challenge. Based on past behavioral observations, and the nature of the use cases of those domains, the likelihood of URLs constructed with those domains being used in any aggressive SMS traffic for genuine purposes is minimal.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Enea has the story.
Here's how it works:
