Attackers exploit URL protection services to conceal malicious links in phishing attacks

Saravanan Mohankumar, Manager, Threat Analyst at Barracuda.
Saravanan Mohankumar, Manager, Threat Analyst at Barracuda.
5 months ago

In a novel attack technique, cybercriminals are abusing legitimate URL protection services to hide malicious URLs in phishing emails, according to a new Threat Spotlight from Barracuda Networks.

From mid-May 2024 onwards, Barracuda researchers observed phishing attacks taking advantage of three different URL protection services to mask their phishing URLs. The services are provided by trusted, legitimate brands. To date, these attacks have targeted hundreds of companies, if not more.

URL protection services work by copying URL links found in emails, rewriting them, and then embedding the original within the rewritten one, rather like a wrap. When the email recipient clicks on the link, it triggers an email security scan of the original URL. If the scan is clear, the user is redirected to the URL. In the attacks seen, the users were redirected to phishing pages designed to steal sensitive information.

Barracuda researchers believe it is likely that the attackers initially gained entry to the URL protection services after compromising the accounts of legitimate users.

Once the attacker had taken over an email account, they could impersonate the owner, and infiltrate and examine their email communications, also known as business email compromise (BEC) or conversation hijacking. Links in emails connected to the account, or in the user’s email signature, would have shown whether a URL protection service was being used, and which one.

Using the compromised account to send themselves a phishing email carrying their malicious link, the attackers would have been able to get the protection URL they needed for their phishing campaigns.

“This inventive tactic helps attackers to evade security detection, and the abuse of trusted, legitimate security brands means that recipients are more likely to feel safe and click on the malicious link,” said Saravanan Mohankumar, Manager, Threat Analyst at Barracuda.

Don't Miss

Charbel Ghostine, Regional Channel & Alliances Director, META & East Med at Barracuda

Barracuda to support Managed Service Providers (MSPs) across Middle East

Barracuda Networks is bringing its global support for MSPs to the Middle

Mindware recognised as Distributor of the Year by Barracuda at Discover24 EMEA

Mindware has been named a Distributor of the Year in the annual