Open Redirects Used to Disguise Phishing Links

Open Redirects Exploited for PhishingPhishing attacks are increasingly using open redirects to evade detection by security filters, according to researchers at Trustwave.

Open redirects are URLs hosted on trusted domains that take users to separate, potentially malicious domains. The researchers explain the process using the example URL “hxxps://goodsite[.]com/redir[.]php?url=hxxp://badsite[.]com.”

  • “Initial Click: The user initially accesses the ‘goodsite[.]com’ domain, which is a trusted and legitimate website."
  • “Triggering the Redirection: The URL contains a query parameter ‘url=http://badsite[.]com’, instructing a redirection to the specified external URL ‘badsite[.]com’."
  • “Absence of URL Validation: ‘goodsite[.]com’ doesn’t verify if the external URL specified in the URL parameter is a legitimate and safe destination."
  • “Automatic Redirection to an Unsafe Site: Since there’s no validation, the user is automatically redirected from goodsite[.]com to hxxp://badsite[.]com. This site is under the control of attackers and could be harmful.”

Trustwave has observed a “significant rise” in phishing attacks using open redirects over the past several months.

“From Q3-Q4 2023, there has been a rise in phishing campaigns using open redirect tactics, because of an increasing number of image-based attacks impersonating brands like Microsoft and e-signature services such as DocuSign and Adobe Sign,” the researchers write.

“As the name implies, image-based attacks use images to carry malicious links allowing it to bypass text-based security filters. The inclusion of open redirect techniques in image-based phishing attacks makes it harder for standard security systems to detect and prevent these phishing schemes.”

The researchers conclude that attackers will always look for new ways to improve social engineering tactics and bypass security technologies.

“Threat actors will continue to evolve their methods, leveraging sophisticated tactics like open redirection and exploitation of trusted platforms for malicious redirection,” Trustwave says. “Their primary goal is to evade detection mechanisms and exploit user trust by taking advantage of the trusted platform’s reputation and employing anti-phishing analysis tactics like intricate redirection chains. This underscores the need for continuous vigilance against cyberthreats, as they persistently evolve and present new challenges.”

KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

Trustwave has the story.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews