Open Redirects Used to Disguise Phishing Links

Phishing attacks are increasingly using open redirects to evade detection by security filters, according to researchers at Trustwave.

Open redirects are URLs hosted on trusted domains that take users to separate, potentially malicious domains. The researchers explain the process using the example URL “hxxps://goodsite[.]com/redir[.]php?url=hxxp://badsite[.]com.”

• “Initial Click: The user initially accesses the ‘goodsite[.]com’ domain, which is a trusted and legitimate website."
• “Triggering the Redirection: The URL contains a query parameter ‘url=http://badsite[.]com’, instructing a redirection to the specified external URL ‘badsite[.]com’."
• “Absence of URL Validation: ‘goodsite[.]com’ doesn’t verify if the external URL specified in the URL parameter is a legitimate and safe destination."
• “Automatic Redirection to an Unsafe Site: Since there’s no validation, the user is automatically redirected from goodsite[.]com to hxxp://badsite[.]com. This site is under the control of attackers and could be harmful.”

Trustwave has observed a “significant rise” in phishing attacks using open redirects over the past several months.

“From Q3-Q4 2023, there has been a rise in phishing campaigns using open redirect tactics, because of an increasing number of image-based attacks impersonating brands like Microsoft and e-signature services such as DocuSign and Adobe Sign,” the researchers write.

“As the name implies, image-based attacks use images to carry malicious links allowing it to bypass text-based security filters. The inclusion of open redirect techniques in image-based phishing attacks makes it harder for standard security systems to detect and prevent these phishing schemes.”

The researchers conclude that attackers will always look for new ways to improve social engineering tactics and bypass security technologies.

“Threat actors will continue to evolve their methods, leveraging sophisticated tactics like open redirection and exploitation of trusted platforms for malicious redirection,” Trustwave says. “Their primary goal is to evade detection mechanisms and exploit user trust by taking advantage of the trusted platform’s reputation and employing anti-phishing analysis tactics like intricate redirection chains. This underscores the need for continuous vigilance against cyberthreats, as they persistently evolve and present new challenges.”

KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

Trustwave has the story.