A new phishing method uses a decades-old special URL format to take advantage of how security solutions and email clients interpret URLs, tricking victims into clicking.
It’s called the HTTP Authorization header and it’s been around since 1999 as part of RFC 2616 which defined HTTP version 1.1. It specifies that an HTTP web request can contain a username and password in a URL just before the fully-qualified domain name. For example:
https://username:password@notarealdomainname.ext
Everything after the double forward slash and before the “@” is interpreted as authentication credentials. A new phishing method spotted by security researchers at Perception Point found that scammers were taking advantage of the “@”, placing it in what would be perceived as the “middle” of a valid URL, only to trick email clients and scanning solutions into interpreting the URL as being benign, when it was anything but.
Take the idea of tricking a user into thinking they were going to be taken to the following URL:
http://www[.]office[.]com[/]login
But the URL actually reads:
http://www[.]office[.]com[/]login@maliciousdomain[.]com
With many web browsers, everything before the “@” is considered authentication details and the destination domain is everything after the “@”. In contrast, the email scanners may not interpret the URL properly at all and deem it not to be a threat.
In the case of the attack found by Perception Point, the URL in question is found in the following image:
The actual URL is the Bitly link which takes victims to a spoofed Microsoft 365 logon page.
The only saving grace would be found in those users that know to scrutinize the final URL they are taken to (which was not Microsoft 365) before they provide credentials. Users that undergo continual Security Awareness Training are taught to always be on guard looking to anything out of the ordinary – whether it be a link with an “@” in the middle of it, or an incorrect URL on a logon page.
Here's how it works:
