“A central part of any conference for a company is to garner interest for their company,” Fuchs explains. “Many conferences will give over lead lists for companies to follow up on. This can be a significant source of potential revenue for companies. This is not the usual fare for hackers. But in a clever twist, hackers insert themselves into the lead delivery process to steal credentials by creating look-a-like webpages on easy-to-use and legitimate developer sites.”
The threat actors are targeting conference attendees with phony offers of business opportunities.
“There’s a lot going on in this attack,” Fuchs writes. “First, there’s the pure impersonation and social engineering of this popular conference. The hackers are using the name of the conference, and the dazzling potential of future business, to get users to click. That’s the first part, which requires fairly little expertise on the part of the hacker. If anything, it shows ingenuity by sending the email within a few days of the conference ending. Because companies tend to post that they are at such conferences on social media, it makes it easy for hackers to identify potential targets.”
The attackers are abusing the legitimate service Surge to host their phishing pages, which can help their emails bypass security scanners.
“What requires more skill is creating the look-a-like page,” Fuchs says. “Luckily for hackers, there are tools that help them along. In this case, it is Surge.sh Surge.SH is not a malicious site, but like many legitimate services, it can be used to foster illegitimate acts. By leveraging the legitimacy of Surge, it allows for the bypassing of security services. Users can spot the plot by seeing that the URL has the Surge domain in it. But even that is potentially tricky. Because Anga Com is in the name of the URL, users might think that Surge is the platform being used to host the leads.”
New-school security awareness training can teach your employees how to thwart phishing and other social engineering attacks.
Avanan has the story.