New Phishing Attack Abuses .Zip Domain to Emulate Fake WinRAR Within the Browser

Google recently released new top-level domains (TLDs) like .dad, .phd, .mov, and .zip, raising concerns within the security community due to the potential confusion with file extensions, particularly .mov and .zip.

A new phishing kit, “file archiver in the browser,” exploits ZIP domains by presenting fraudulent WinRAR or Windows File Explorer windows in the browser, tricking users into executing malicious files.

Last week, security researcher mr.d0x revealed a phishing attack that involved mimicking a browser-based file archiver software like WinRAR using a .zip domain to enhance its credibility.

How the Attack Works

To perform this attack, emulate the WinRAR file archive utility using HTML/CSS, with the expert uploading 2 samples on GitHub for public access.

The other one mimics the File Explorer window found in Windows 11.

The WinRAR sample incorporates cosmetic features, such as a ‘Scan’ icon that generates a message box confirming file safety, enhancing the legitimacy of the phishing page.

The toolkit enables embedding a counterfeit WinRar window in the browser, creating the illusion of opening a ZIP archive and displaying its contents when accessing a .zip domain.

It looks great in the browser, but it truly stands out as a popup window, as with the address bar and scrollbar removed, it resembles a WinRar window on the screen.

An intriguing application involves listing a non-executable file that, upon user click, triggers the download of an executable file or any desired file format, such as a .exe, even when the user expects to download an “invoice.pdf” file.

File Explorer Search Bar

Several Twitter users highlighted that the Windows File Explorer search bar serves as an effective delivery method, as searching for a non-existent file like “mrd0x.zip” prompts automatic opening in the browser, which aligns perfectly with user expectations of encountering a ZIP file.

Once the user performs this action, it automatically launches the .zip domain containing the file archive template, creating a convincingly authentic appearance.

Introducing new top-level domains (TLDs) expands the phishing possibilities for attackers, prompting organizations to block .zip and .mov domains due to their current and expected future exploitation for phishing activities.

Phishing attacks are growing in sophistication as cybercriminals increasingly incorporate detection evasion features like antibots and dynamic directories into their kits.

In 2022, the number of advanced phishing attacks by threat actors surged by 356%, while the overall attack count saw an 87% increase throughout the year.

A new wave of phishing attacks is using compromised Microsoft 365 accounts and restricted-permission message (.rpmsg) encrypted emails to steal users’ credentials, showcasing the ongoing evolution of phishing schemes.

Shut Down Phishing Attacks with Device Posture Security – Download Free E-Book

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…

10 hours ago

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…

2 days ago

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…

2 days ago

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…

2 days ago

Google Chrome Security, Critical Vulnerabilities Patched

Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…

3 days ago

Notorious WrnRAT Delivered Mimic As Gambling Games

WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…

3 days ago