830 Organizations Hacked via Glitch-hosted Phishing Attack Uses Telegram & Fake CAPTCHAs

Netskope Threat Labs reported a staggering 3.32-fold increase in traffic to phishing pages hosted on the Glitch platform, a browser-based web development tool that allows users to create and deploy web apps with free subdomains.

This alarming spike has impacted over 830 organizations and more than 3,000 users, with Navy Federal Credit Union members being the primary targets.

These sophisticated campaigns are designed to steal sensitive data, including login credentials, credit card details, and email passwords, while also exploiting location-tracking services like ipify and ipinfo to gather victims’ IP addresses, countries, and cities via JavaScript.

Phishing Traffic Targets Navy Federal Credit Union

The attackers leverage Glitch’s free-tier features, such as unlimited hosting for static sites and the “Remix” functionality, to rapidly deploy multiple phishing pages under unique, hyphenated subdomains (e.g., projectname-projectname-projectname.glitch[.]me), making detection and takedown efforts challenging.

A deeper dive into these phishing operations reveals two particularly insidious techniques.

Approximately half of the campaigns abuse Telegram’s BotAPI, using the sendMessage method to exfiltrate stolen data, including one-time passwords (OTPs) critical for bypassing multi-factor authentication (MFA).

Victims are prompted to enter OTPs sent to their phones, which are then relayed to attackers in real-time, granting unauthorized access to accounts for fraudulent transactions.

Fake CAPTCHA Tactics

In cases where victims cannot provide an OTP, attackers encourage placeholders like “0000” before soliciting additional sensitive data such as email credentials, potentially enabling account reset exploits.

Equally concerning is the use of custom-built fake CAPTCHAs in some campaigns to thwart static web scanners.

These deceptive tests, initiated by a “bot-check” checkbox, use JavaScript to simulate a verification process with a spinning loader, ultimately redirecting unsuspecting users to the phishing payload while keeping the malicious content hidden from automated security tools.

The implications of these tactics are profound, as they not only exploit human trust but also undermine traditional security mechanisms.

Beyond Navy Federal Credit Union, the campaigns target T-Mobile accounts and other banking and email services, often mimicking payment pages to extract credit card details and displaying fake success messages to maintain the illusion of legitimacy.

Netskope Threat Labs notes that Glitch is just one of many free hosting platforms abused for phishing, with prior instances involving AWS Amplify, Webflow, and CloudFlare Workers.

The ease of creating and duplicating phishing sites on such platforms underscores the need for heightened vigilance and advanced threat detection.

As these Glitch-hosted campaigns continue to evolve, Netskope remains committed to monitoring and mitigating their impact, urging users to avoid entering sensitive information on suspicious subdomains and to remain cautious of social engineering tricks like fake CAPTCHAs.

This escalating threat landscape serves as a stark reminder of the importance of robust cybersecurity defenses and user awareness in combating increasingly sophisticated phishing attacks that exploit legitimate services for malicious gain.

To Upgrade Your Cybersecurity Skills, Take Diamond Membership With 150+ Practical Cybersecurity Courses Online – Enroll Here