A recent report by Group-IB has exposed a highly advanced phishing campaign targeting employees from 30 companies across 15 jurisdictions. Using trusted domains and cutting-edge personalization techniques, attackers have bypassed Secure Email Gateways (SEGs) and exploited victims in critical sectors such as finance, government, aerospace, and energy.
Advanced Obfuscation and Multi-Layered Deception
The investigation, initiated in July 2024, uncovered the attackers' use of:
- Over 200 phishing links hosted on legitimate platforms like Adobe’s InDesign cloud service and Google AMP.
- Techniques to bypass detection systems that typically block suspicious or unknown domains.
“Nine out of ten cyberattacks start with a phishing email, making it the most common entry point for threat actors,” the report emphasized.
Phishing Emails That Mimic Trusted Brands
The attackers used professionally designed phishing emails that impersonated well-known brands, including:
- DocuSign, prompting victims to sign fake contracts.
- Adobe-hosted links, disguising fraudulent login pages as critical documents.
These emails featured professional formatting, familiar logos, and dynamically personalized elements. For example, by extracting a victim’s email domain, the attackers matched logos and page titles to the targeted organization, enhancing credibility.
“Scammers use a technique that dynamically pulls company logos from the official website to make the phishing links look legitimate,” the report noted.
Exploitation of APIs for Realistic Branding
The attackers leveraged APIs like https://logo.clearbit.com/[company domain] to integrate authentic logos into phishing sites. This seamless branding approach increased user trust and made phishing attempts harder to detect.
Concealing Operations with URL Redirection and Encoding
To evade detection, attackers used:
- URL redirections via Google AMP to create complex trails.
- Encoded parameters to obscure the attack path.
Victims were redirected to phishing pages that appeared legitimate, with pre-filled email addresses further enhancing the illusion of authenticity. Once users entered their credentials, the stolen data was sent to Command-and-Control (C2) servers or Telegram bots via API endpoints.
Advanced Data Exfiltration Techniques
The phishing sites contained JavaScript snippets that transmitted stolen credentials using Base64 encoding, effectively hiding the data during analysis. Group-IB analysts observed: “The JSON response from Telegram’s API confirms that the stolen credentials were successfully sent to a private chat controlled by the attacker.”
Ongoing Evolution in Phishing Tactics
Group-IB warns that these techniques signify a continuous evolution in phishing methodologies: “Threat actors are quickly adapting, constantly refining and improving their techniques to bypass security measures and exploit vulnerabilities.”
Conclusion: A Growing Need for Vigilance
This campaign serves as a stark reminder of the ever-evolving nature of cyber threats. Organizations must strengthen their defenses and educate employees to identify and respond to increasingly sophisticated phishing attempts.