Saturday, May 18, 2024

Beware: Innovative Phishing Threat Targeting Facebook Mobile Users

In the past, we came through a number of Phishing campaigns where the attackers using Valid TLD itself for phishing and the Punycode attack demonstrated by Xudong Zheng.

Now hackers find a new way innovative method to create believable URL’s and targeting mobile users, specifically Facebook users.Security experts from Phishlabs came through this new campaign targeting mobile users.

Security expert Crane Hassold says “Instead of attempting to make genuine looking
URLs, threat actors have begun including genuine, legitimate domains within a
longer URL, and padding it with hyphens to hide the real target“.

For Example

hxxp://m.facebook.com-------------validate----step1.rickytaylk[dot]com/sign_in.html

You can see the URL starts with m.facebook.com but the real destination URL here is rickytaylk.com, not  m.facebook.com.

Innovative Phishing Threat Targeting Facebook Mobile Users
Source: PHISHLABS

You can see the screenshot, where you can see only the m.facebook.com and an endless stream which hides the original target address.This smart addition of the Facebook favicon in the address bar looks like the site is exceptionally genuine.

Lack of attention

Inattentive mobile users easily fall into the trap and give away their valuable credentials to the attackers. Generally, these phishing URL’s are transferred through SMS, Chats, and Emails.

Here you can see some more examples.

hxxp://login.Comcast.net-------account-login-confirm-identity.giftcardisrael[dot]com/      
hxxp://accounts.craigslist.org-securelogin--------------viewmessage.model104[dot]tv/craig2/  
hxxp://offerup.com------------------login-confirm-account.aggly[dot]com/Login%20-%20OfferUp.htm  
hxxp://icloud.com--------------------secureaccount-confirm.saldaodovidro[dot]com.br/

Crane Hassold says “it’s highly likely that this tactic is being distributed via SMS phishing or through the social messenger, rather than email”.

One can easily identify the Phishing URL that sent through email by just hovering our the link, but that is not possible if the URL provided through SMS.

Security researchers said they have spotted more than 50 attacks of this type and has a rapid growth from last March.

Hackers not using this method for credential harvesting alone, they use to send more phishing URL’s via status updates or private messages.

Common Defence’s against phishing

  • We know logically the organizations like Facebook will not send the login URL through SMS. You should think that before opening.
  • Always make sure that you entering Login credentials and Card details on a HTTPS page.
  • Don’t open the attachments that you are not expecting.
  • Hover the URL to find the URL’s Integrity.
  • It is always better to type the URL directly in the address bar.
Website

Latest articles

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that...

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices,...

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine,...

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers...

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information...

Russian APT Hackers Attacking Critical Infrastructure

Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated...

Millions Of IoT Devices Vulnerable To Attacks Leads To Full Takeover

Researchers discovered four significant vulnerabilities in the ThroughTek Kalay Platform, which powers 100 million...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles