Attackers are abusing the storage and sharing features of Kuse, a free AI app, to assist in phishing campaigns, according to researchers at Trend Micro. Kuse is a legitimate agentic AI platform used by employees to streamline workflows. Users can share files with coworkers, which generates a link hosted by Kuse’s domain. In this case, attackers are abusing the share feature to generate legitimate-looking phishing links.
“The URL used the legitimate domain app[.]kuse[.]ai and contained spaces, commas, and periods,” Trend Micro explains. “Moreover, the URL mimicked a legitimate document using the compromised vendor’s company name. These links were presumably put in emails sent from mailboxes belonging to the compromised vendor, aimed at the target organization. This tactic was meant to confuse users and automated scanners. Because the Markdown file extension (.md) is less commonly used in phishing attempts than document (e.g., .pdf, .docx) and webpage (e.g., .html, .aspx) file extensions, it can bypass filter signatures and heuristic rules that focus on more typical malicious file extensions.”
If a user clicked the link, they’d be taken to a legitimate Kuse workspace that displayed a blurred document preview accompanied by another link to reveal the document. This link led to a spoofed Microsoft login page designed to steal the user’s credentials.
“Threat actors are always looking for new vectors to exploit the inherent trust placed in legitimate platforms,” Trend Micro says. “They abuse the storage and sharing capabilities of free services, as well as the growing interest in AI-powered web applications. Using the Markdown (.md) file extension as the delivery format, combined with a VEC to establish trust at the point of delivery, demonstrates a multi-layered social engineering approach designed to evade both automated defenses and human scrutiny, which in turn highlights the need for layered protection and heightened user awareness.”
KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Trend Micro has the story: Kuse Web App Abused to Host Phishing Document
