Cross-Site Scripting (XSS) is alive and well, and used in attacks to obfuscate malicious links in phishing emails to redirect users to threat-actor controlled websites.
We saw earlier this year that phishing attacks leveraging XSS were on the rise. Now, new scams are using XSS to hide their malicious intent within emails, according to new analysis from cybersecurity vendor INKY.
These attacks usually begin with an email stating the victim has won something, as shown below:
Source: INKY
The URL associated with the “Get Started Now” link is actually a simple benign link to a website with a query of “q=” and a long string of characters – which is encoded JavaScript code designed to inject a script into the web page to redirect the browser to a new threat actor-controlled location.
This relatively simple scam is easy to identify, as brands like Marriott, Harbor Freight, Lowes and Costo (brands impersonated in this scam) aren’t in the business of giving things away.
Users that have undergone new-school security awareness training are keenly aware of the fact that “when it looks too good to be true, it is”, and will simply delete the email before enabling any of its’ malicious functionality.
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
