Phishing Campaigns Using Google Firebase Storage

iStock-489433406Scammers are hosting phishing pages on Google Firebase Storage to bypass email security filters, Threatpost reports. Firebase is a Google-owned application development platform that provides secure storage in Google Cloud. Researchers at Trustwave SpiderLabs have observed several phishing campaigns abusing this cloud infrastructure to obtain URLs that won’t be blocked by email gateways.

The phishing emails themselves aren’t particularly noteworthy. They use various templates spoofing Outlook, Office 365, Bank of America, and others to trick recipients into clicking a link that will take them to a phishing site designed to steal their credentials or financial information.

The use of Firebase URLs is significant, however. One of the biggest hurdles in a phishing campaign is actually getting the emails into recipients’ inboxes. Email security solutions have gotten better at detecting emails that contain links to suspicious websites, so attackers prefer to host their phishing sites on reputable infrastructure. If enough people receive the emails—even if the templates aren’t very refined—at least some recipients will probably fall for the scam.

Karl Sigler, senior threat intelligence manager of Trustwave’s SpiderLabs, told Threatpost that this technique is growing more common.

“Since it’s using Google Cloud Storage, credential-capturing webpages hosted on the service are more likely to make it through security protections like Secure Email Gateways due to the reputation of Google and the large base of valid users,” Sigler said. “The use of cloud infrastructure is rising among cybercriminals in order to capitalize on the reputation and valid uses of those services. They tend to not be immediately flagged by security controls just due to the URL.”

Sigler added that these campaigns highlight the need for user education about social engineering techniques.

“Again, because of the valid uses and large user base of these services, many of these phishing emails can slip through the cracks of the security controls we put in place,” Sigler said. “Educating users about these tactics helps provide defense-in-depth against these techniques when they hit a victim’s inbox.”

Attackers will always find ways to overcome technical defenses. New-school security awareness training can teach your employees how to recognize and thwart both sophisticated and generic phishing attempts.

Threatpost has the story:

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews