Targeted phishing gets a new hook with real-time email validation – Source: www.csoonline.com

Crooks behind some credential-stealing phishing campaigns are trying to increase their success rate by sophisticated targeting.

According to researchers at Cofense, instead of blasting out mass messages to a list of email addresses they’ve collected or bought, these threat actors only target addresses that have been verified as active, legitimate, and often high-value.

Cofense calls the technique precision-validated phishing, or real-time email validation, and it works like this: When someone who falls for a pitch attempts to access the crook’s phishing page, their email address is checked against the attacker’s database, via JavaScript-based validation scripts on the page, before the fraudulent credential stealing login form is displayed. If the email address entered does not match any from the pre-defined list, the phishing page either returns an error or redirects to a legitimate, benign-looking, page. If the address is confirmed, however, the fake login page that can capture the victim’s credentials is displayed.

Problem for defenders

The problem facing defenders is the tactic prevents security teams from doing further analysis and investigation, says the Cofense report. Automated security crawlers and sandbox environments also struggle to analyze these attacks because they cannot bypass the validation filter, the report adds.

Also, the report says, the selective nature of these attacks makes detection through threat intelligence sharing more difficult. Since the phishing pages do not serve malicious content to everyone, some traditional URL scanning tools may fail to flag them as threats. “This undermines traditional blocklisting efforts, requiring organizations to shift toward behavioural analysis and anomaly detection to identify phishing campaigns before they reach end users,” the report says. 

‘A little bit of hype’

David Shipley, head of Canadian-based security awareness training firm Beauceron Security, said “there’s a little bit of hype” in giving the tactic a fancy name for what is in fact spear phishing, although, he admitted, it’s “rapid-fire spear phishing.”

The reason, he said, is that “spray-and-pray” mass phishing campaigns today are being detected by email gateways. This is why threat actors have increasingly turned to spear phishing and what he calls “trolling” campaigns, where the goal is to measure who will report a phishing attempt, who will click, and where on the message the target will click. “They’re trying to figure things out ahead of doing something clever,” he said.

The report is a reminder to infosec pros that, despite improved defenses, phishing is still a prime tactic of threat actors, Shipley said. “You can have a false sense of security if you’re running a large enterprise and say, ‘We stopped 950,000 phishing emails this month.’ But the 500 that got through could really sink the battleship.”

The lesson for CISOs, he added, is to emphasize to employees the importance of reporting suspected phishing emails instead of just deleting them.

‘Hard to defend against’

“This is very difficult to defend against,” said Johannes Ullrich, dean of research at the SANS Institute. “The first step is to restrict JavaScript access. Next, mail servers need to rate limit requests to restrict how often a particular source may use its API. But it is very difficult to find the ‘right’ rate limit.”

“The only real solution,” he said, “is to move away from traditional credentials to phishing-safe authentication methods like Passkeys. The goal should be to protect from leaked credentials, not block user account verification.”

Attackers verifying e-mail addresses as deliverable, or being associated with specific individuals, is nothing fundamentally new, he added. Initially, attackers used the mail server’s “VRFY” command to verify if an address was deliverable. This still works in a few cases. Next, attackers relied on “non-deliverable receipts,” the bounce messages you may receive if an email address does not exist, to figure out if an email address existed. Both techniques work pretty well to determine if an email address is deliverable, but they do not distinguish whether the address is connected to a human, or if its messages are read.  

The next step, Ullrich said, was sending obvious spam, but including an “unsubscribe” link. If a user clicks on the “unsubscribe” link, it confirms that the email was opened and read. So current advice is to not use the unsubscribe link unless you know the organization sending the email, he said.

With web mail systems, it is often possible for a threat actor to figure out if a particular account exists by just attempting to log in, he noted. The attacker may get a different response if the account doesn’t exist, versus ‘incorrect password’ for an existing account. For public systems like Gmail or Hotmail, an attacker may also attempt to create a new account, and the system will warn them if a particular username is already taken.

“It looks like this campaign added the ability to verify if an email address exists in real time,” he said. “Most webmail systems are built around APIs accessible from JavaScript, and an attacker can use these APIs or create a database of valid email addresses or some middleware to proxy the requests to the email services API in case they restrict JavaScript access.”