Attackers are abusing a legitimate service called “GeoTargetly” to launch localized phishing attacks, according to Jeremy Fuchs at Avanan. GeoTargetly is meant to be used by advertisers to display ads in countries’ local languages. Avanan observed a phishing campaign that’s using phishing emails to target multiple countries in South America.
“The original email is essentially about a local traffic ordinance–which may not be enough to get people to click,” Fuchs explains. “However, the email itself is not what’s interesting–what is interesting is the ability for hackers to customize their attacks by region, and to attack multiple users in multiple parts of the world at once.”
Fuchs notes that the emails themselves are untargeted, and the attackers simply send out so many emails that some people are bound to fall for them.
“Spray-and-pray is a common technique of threat actors,” Fuchs says. “The idea–throw a bunch of things at the wall and see what sticks. The name of the game is volume, and you’re hoping for a few successful phishes here and there.”
In this case, however, the threat actors are using a new technique to make these campaigns somewhat more precise.
“[This attack] is a different kind of spray-and-pray,” Fuchs writes. “It allows for the ability for hackers to target a large number of people at once, and ensure that it’s relevant, and localized. It’s spraying without the praying. Using the GeoTargetly redirect, a hacker can create a phishing link that redirects users in a certain region to a fake login page that looks identical to the original one. This personalization increases the chances of a user falling for the attack. The redirect is legitimate and the content would be relevant to their language and region. This has increased the likelihood of spray and pray are working, and would allow hackers to operate on a global nature seamlessly.”
New-school security awareness training can give your employees a healthy sense of suspicion so they can avoid falling for social engineering attacks.
Avanan has the story.
Here's how it works:
