Article contributed by Ethan Fite
A recent wave of phishing campaigns is leveraging cleverly disguised URLs and Microsoft 365 (O365) password expiry lures to trick users into divulging sensitive credentials. Here’s what we know:
1) Phishing Lure
• The email subject consistently follows the format: “ACTION Required - [Client] Server SecurityID:[random string]”.
• The body of the email urges the recipient to reconfirm their password due to expiry, with clickable buttons labeled “Keep [USER EMAIL] Access Active.”
2) Tactics
• Fake YouTube Links: Attackers embed links starting with a legitimate-looking URL (e.g., youtube.com) followed by a series of obfuscation characters like %20.
• URI Obfuscation: Using the @ symbol in the URL, the attackers direct users to a malicious domain (e.g., globaltouchmassage[.]net) while making the URL appear trustworthy.
3) Notable Indicators
• Embedded URLs use excessive %20 (HTML space encoding).
• URLs include an @ symbol that segments the URL into two parts:
• The domains used include redirectors and standard phishing templates utilized by Tycoon 2FA, Mamba 2FA, and EvilProxy kits.
When a URL includes an @ symbol, browsers interpret everything before it as user credentials and redirect to the domain after the @. For example:
• URL: youtube.com%20%20%20%20@testing123.net
• Destination Domain: testing123.net.
This tactic abuses legitimate services like YouTube in the URL structure to lend credibility to the link. Users are more likely to trust the link without inspecting it closely.
• Example Phishing URL:
https://youtube.com%20%20%20%20%20%20%20%20%20%20%20@globaltouchmassage[.]net/ssy/cmd
• Common Subject Lines:
"ACTION Required - [Client] Server SecurityID:[random string]"
1) Educate Users
• Always inspect URLs for unusual structures or unexpected symbols (%20, @).
• Be wary of emails urging immediate action regarding passwords or accounts.
2) Technical Mitigations
• Deploy URL filtering and blocklists to catch domains like globaltouchmassage.net.
• Use sandbox tools to analyze suspicious links safely.
3) Report and Monitor
• If you suspect phishing, report it to your IT/security team immediately.
As phishing tactics evolve, attackers continue to exploit trust in legitimate services. Stay vigilant and always verify links before clicking. Keep your workforce informed and your systems protected.
For more cybersecurity tips, follow Cyderes on LinkedIn and X.