Monday, May 5, 2025
HomeAmazon AWSHackers Mimic Google, Microsoft & Amazon Domains for Phishing Attacks

Hackers Mimic Google, Microsoft & Amazon Domains for Phishing Attacks

Published on

SIEM as a Service

Follow Us on Google News

Phishing remains a significant concern for both individuals and organizations. Recent findings from ThreatLabz have highlighted the alarming prevalence of phishing attacks targeting major brands, with Google, Microsoft, and Amazon emerging as the top three most impersonated companies.

This article explores the intricacies of these phishing tactics, the role of certificate authorities and domain registrars, and the broader implications for cybersecurity.

The Rise of Phishing: Google Leads the Pack

Phishing attacks have become increasingly sophisticated, leveraging brand recognition to deceive unsuspecting users.

- Advertisement - Google News

According to ThreatLabz, Google accounted for the highest percentage of typosquatting and brand impersonation instances at 28.8%.

Microsoft followed closely at 23.6%, with Amazon at 22.3%. Meta, although also targeted, was far less affected at 4%.

Decoding Compliance: What CISOs Need to Know – Join Free Webinar

The reason behind targeting these tech giants is clear: their vast global user bases offer a lucrative pool of potential victims.

Attackers mimic these brands to exploit the trust users place in them, making it easier to extract sensitive information or distribute malware.

The most imitated brands by typosquatting and brand impersonation.
The most imitated brands by typosquatting and brand impersonation.

Certificate Authorities: A Double-Edged Sword

One of the key tactics used by threat actors is the exploitation of HTTPS to create a facade of legitimacy for their phishing sites.

Among the analyzed phishing domains, 48.4% were found to have certificates issued by Let’s Encrypt.

This free and open certificate authority is popular due to its ease of use and minimal security checks, making it an attractive option for cyber criminals.

Google Trust Services accounted for 21.5% of the certificates, benefiting from Google’s strong brand trust.

GoDaddy issued 15.2% of the certificates, underscoring its significant market presence and the convenience it offers when registering domains.

The most common certificate authorities used by typosquatting and brand impersonation domains.
The most common certificate authorities used by typosquatting and brand impersonation domains.

Domain Registrars: The Backbone of Phishing Operations

Domain registrars play a crucial role in the registration of typosquatting and impersonation domains.

GoDaddy emerged as the most abused registrar, with 21.7% of the instances, followed by NameCheap at 7.3%, and NameSilo at 6.4%.

These registrars are favored by attackers for their reputation, cost-effectiveness, and privacy options.

Threat actors often choose commonly used top-level domains (TLDs) to make their phishing sites appear more legitimate.

The .com TLD was the most popular, used in 39.4% of cases. Interestingly, less common TLDs like .xyz and .top also saw significant use, at 11.1% and 5.4% respectively, likely due to their lower registration costs.

Malware Distribution

One notable example of malware distribution involved the domain “acrobatbrowser[.]com”, which impersonated Adobe.

The site displayed a fake Adobe page, automatically downloading an MSI file disguised as an Adobe plugin.

This file contained the Atera Remote Access Trojan (RAT), allowing attackers to gain remote control over a victim’s device.

Credential Theft

ThreatLabz identified the domain “offlice365[.]com” as a typosquatting site designed to steal credentials.

By mimicking the legitimate Office 365 website, it tricked users into entering their login information, which was then harvested by attackers.

Example typosquatting domain designed to trick users into providing their login credentials for Office 365.
Example typosquatting domain designed to trick users into providing their login credentials for Office 365.

Scammers have also used typosquatting to impersonate Amazon on platforms like WhatsApp, luring victims into sharing personal information.

Additionally, domains like “onedrivesync[.]com” have been used for command-and-control (C2) communication, disguising malicious activities as legitimate Microsoft OneDrive operations.

Typosquatting and brand impersonation remain potent tools in the arsenal of cybercriminals. By exploiting typographical errors and the trust users place in well-known brands, these deceptive domains can lead to significant data breaches and financial losses.

Understanding these tactics is crucial for both users and organizations to recognize and defend against phishing attacks.

Simulating Cyberattack Scenarios With All-in-One Cybersecurity Platform – Watch Free Webinar

Latest articles

Gunra Ransomware’s Double‑Extortion Playbook and Global Impact

Gunra Ransomware, has surfaced as a formidable threat in April 2025, targeting Windows systems...

Hackers Exploit 21 Apps to Take Full Control of E-Commerce Servers

Cybersecurity firm Sansec has uncovered a sophisticated supply chain attack that has compromised 21...

Hackers Target HR Departments With Fake Resumes to Spread More_eggs Malware

The financially motivated threat group Venom Spider, also tracked as TA4557, has shifted its...

RomCom RAT Targets UK Organizations Through Compromised Customer Feedback Portals

The Russian-based threat group RomCom, also known as Storm-0978, Tropical Scorpius, and Void Rabisu,...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Gunra Ransomware’s Double‑Extortion Playbook and Global Impact

Gunra Ransomware, has surfaced as a formidable threat in April 2025, targeting Windows systems...

Hackers Exploit 21 Apps to Take Full Control of E-Commerce Servers

Cybersecurity firm Sansec has uncovered a sophisticated supply chain attack that has compromised 21...

Hackers Target HR Departments With Fake Resumes to Spread More_eggs Malware

The financially motivated threat group Venom Spider, also tracked as TA4557, has shifted its...