Windows 10 News and info | Forum
January 18, 2020, Loading... *
Welcome, Guest. Please login or register.

Login with username, password and session length
News: This is a clean Ad-free Forum and protected by StopForumSpam, Project Honeypot, Botscout and AbuseIPDB | This forum does not use audio ads, popups, or other annoyances. New member registration currently disabled.
  Website   Home   Windows 8 Website GDPR Help Login Register  
By continuing to use the site or forum, you agree to the use of cookies, find out more by reading our GDPR policy.
Pages: [1]
Share this topic on Del.icio.usShare this topic on DiggShare this topic on FacebookShare this topic on GoogleShare this topic on MySpaceShare this topic on RedditShare this topic on StumbleUponShare this topic on TechnoratiShare this topic on TwitterShare this topic on YahooShare this topic on Google buzz
Author Topic: Microsoft Warns of Phishing Attacks Using Custom 404 Pages  (Read 66 times)
Hero Member
Online Online

Gender: Male
United States United States

Posts: 30921

I Do Windows

WWW Email
« on: August 16, 2019, 11:18:54 AM »

Microsoft security researchers discovered an unusual phishing campaign which employs custom 404 error pages to trick potential victims into handing out their Microsoft credentials.

To do this, the attackers register a domain and instead of creating a single phishing landing page to redirect their victims to, they configure a custom 404 page which shows the fake login form.

This allows the phishers to have an infinite amount of phishing landing pages URLs generated with the help of a single registered domain.

"The 404 Not Found page tells you that you’ve hit a broken or dead link – except when it doesn’t," says Microsoft's research team.

"Phishers are using malicious custom 404 pages to serve phishing sites. A phishing campaign targeting Microsoft uses such technique, giving phishers virtually unlimited phishing URLs."

Phishing landing page

Landing pages disguised as Microsoft sign-ins

The custom 404 error pages these attackers use to harvest their victims' credentials are perfectly camouflaged as legitimate Microsoft account sign-in pages, down to the smallest details.

All the links on the phishing page, including the ones at the bottom and the ones used to access one's Microsoft account and to create a new one, are directing straight to official Microsoft login forms in an effort to make targets less suspicious.

The only elements missing from the phishing page are the "Sign-in options" link above the "Next" button and the cookies notification at the top of the page.

"Because the malformed 404 pages are served to any non-existent URL in an attacker-controlled domain, the phishers can use random URLs for their campaigns," adds Microsoft. "We also found that the attackers randomize domains, exponentially increasing the number of phishing URLs."

Exfiltrating Microsoft credentials

The phishing form is designed to collect Microsoft email addresses, phone numbers, or Skype names, that get sent to hotelseacliff[.]com.

The victims are then redirected to a real Microsoft login form masked with a shortened URL after successfully harvesting the credentials.

While Microsoft has already added the URLs used in this campaign to Microsoft Defender SmartScreen's list of reported phishing, malware, exploit, and scam sites, Google is yet to pick them up and add it to its Safe Browsing blacklist service.

Hosting the custom 404 phishing pages

While custom 404 error pages can be created using several different methods and services, the operators of the phishing campaign spotted by Microsoft's security research team used the free outlookloffice365user09ngxsmd[.]web[.]app Firebase subdomain.

A support article on the Firebase documentation website shows all the steps one has to go through to customize a 404/Not Found page, making it possible to "serve a custom 404 Not Found error when a user tries to access a page that doesn't exist."

Once everything is set up, "Firebase Hosting will display the content of this custom 404.html page if a browser triggers a 404 Not Found error on your domain or subdomain."

SmartScreen blocking one of the 'custom 404' phishing pages

As previously mentioned, attackers could also use other technique of creating phishing landing pages via custom 404 Not Found pages, from self-hosted ones to Amazon CloudFront, Microsoft Azure, Squarespace, Weebly, and a lot more.

This means that each of these services could be abused in similar phishing campaigns, with Microsoft's own Azure Storage being a prime target, seeing that it can be used for static website hosting and it also provides support for custom 404 pages.

Phishers are already using Microsoft's Azure Blob Storage object storage solution to host phishing pages, at the same time taking advantage of the fact that they will automatically get signed with an SSL certificate from Microsoft.

This makes Azure Blob Storage-based phishing the ideal method to directly target users of Microsoft services such as Office 365, Azure Active Directory, Outlook and a whole slew of other Microsoft logins.

« Last Edit: August 16, 2019, 11:28:37 AM by javajolt » Logged

Pages: [1]
Jump to:  

Powered by SMF 1.1.21 | SMF © 2017, Simple Machines

Google visited last this page August 17, 2019, 11:02:31 AM