Researchers have discovered a new phishing marketing campaignthat uses captcha bins to bypass "safe electronic mail gateways" (SEGs) and run a fake Microsoft.
Companies use SEGs to ensure that the emails they receive are “clean,” meaning they don’t contain any viruses. SEGs are responsible for scanning all messages, both internal and external, to ensure that they don’t contain malicious content. It acts as a shield against phishing and other attacks.
Captcha prevents automatic scanning
Captcha is a type of test used to determine whether a user is human or a bot. It is designed to detect and block suspicious activity.
However, the hackers managed to use Captcha to disguise the fake page they created, after blocking the URL parsing.
"SEG cannot go ahead and scan the malicious page, but only the Captcha code site. This site does not contain any malicious content, so SEG considers it safe," the researchers said.
The attackers aimed to obtain credentials Microsoft account , so they created a fake login page that closely resembles the company's original page.
If a user enters the fake page and types in their credentials or any other information, hackers will have access to them.
According to researchers, the email with the phishing link comes from a compromised account from “avis.ne.jp.”
The email has an option that offers the ability to preview the alleged communication. If someone clicks on this option, they will be taken to the page with the captcha code.
Both the phishing pages and the captcha are hosted on Microsoft's infrastructure. For this reason, SEGs cannot detect anything unusual when parsing the URL. The domains appear legitimate.
Cybercriminals are constantly finding new ways to trick their victims and the programs they use. As seen in this case (and other attacks), they have begun to use tools that are normally designed to provide security, but they are exploiting them in such a way that they help in their scams.
In the past, some hackers have used QR codes to redirect victims to phishing pages. QR codes are also often used to create security programs.
