Cybercriminals exploited an open redirect on the official UK DEFRA website to mislead visitors, sending them to fake OnlyFans adult dating pages.
See also: OnlyFans changes plans: Finally allows sexual content
OnlyFans is a platform that allows content creators to earn money by offering exclusive content, such as videos and photos, to their subscribers. Its popularity has grown in recent years, with many celebrities and influencers using the platform to earn money through their content.
As OnlyFans is a widely known and used platform, malicious individuals have created fake adult dating pages using the name in an attempt to attract subscribers or extract personal information from unsuspecting people.
This malicious attack involved a fraudulent UK government link that tricked visitors into sending them to the fake dating site OnlyFans via an open redirect.
See also: OnlyFans: Bans videos with sexual content
Redirects are legitimate website links that immediately direct users from their original destination to another website address, usually an external page. For example, a website might have this redirect: www.example.com/redirect/www.google.com, which when clicked will take you directly to Google with just one click!
Open redirects can be easily exploited by malicious actors, allowing them to create fraudulent links from trusted websites to any other website of their choosing.
Last week, analysts at Pen Test Partners stumbled upon a malicious campaign that exploited an open redirect to DEFRA's river conditions website.
Google's indexing bots detected these redirects listed as search results, which were likely added to websites and promoted pornographic or adult websites .
See also: OnlyFans: Inappropriate content leaked - How can content creators see if they have been affected?
Posing as OnlyFans pages, these fraudulent websites trick users into answering a series of questions about the type of “date” they desire and ultimately redirect them to online adultery platforms. For years, malicious actors have been exploiting government-run open redirect sites to promote their malicious agenda and host adult phishing sites .
