Cybercriminals introduce new phishing tactics to net victims

Image by NuTz_C | Bigstockphoto

Barracuda has uncovered three new phishing tactics cybercriminals are using to trick users, bypass security measures and avoid detection, according to its most recent Threat Spotlight.

Three novel phishing tactics

Analysing data from thousands of phishing emails blocked by Barracuda systems during January 2023, researchers identified three novel tactics being used to defy security teams and net unsuspecting victims. These include the misuse of web translation, image-only emails, and the insertion of special characters.

Phishing attacks continue to make the headlines in Singapore and the wider Asia-Pacific region, with hackers using the attacks to steal user data, including login credentials and credit card numbers. According to Barracuda, these attacks are constantly evolving as attackers introduce new techniques and tactics to outsmart security teams.

Attacks using Google Translate web links

In the first of the novel tactics to be uncovered, Barracuda researchers found evidence of hackers using Google Translate web links to mask malicious URLs (web page addresses). In these attacks, scammers use poorly-formed HTML pages or a non-supported language to prevent Google from translating the webpage – and Google responds by providing a link back to the original URL stating that it cannot translate the underlying website.

The attackers embed that URL link in an email, and if a recipient clicks on it, they are taken to a fake but authentic-looking website that is, in fact, a phishing website controlled by the attackers. Affecting at least one-in-eight organisations (13%) being targeted by an average of eight emails during January 2023, these emails are incredibly difficult to detect, as they contain a URL that points to a legitimate website.

Image-based attacks

Barracuda researchers also saw around one in ten (11%) organisations being targeted by at least two image-based attacks, which did not contain any text. These images, which can be fake forms such as invoices, tend to include a link or a call-back phone number that, when followed up, leads to phishing. Because these attacks do not include any text, traditional email security can struggle to detect them.

Special-character attacks

Hackers often use special characters, such as zero-width Unicode code points, punctuation, non- Latin script, or spaces, to evade detection. This type of tactic is also used in “typo-squatting” web address attacks, which mimic the genuine site but with a slight misspelling.

When they are used in a phishing email, the special characters are not visible to the recipient. They can be inserted into a malicious URL embedded in a phishing email, breaking the URL pattern so that security technologies do not detect it as malicious. Detection of such attacks can also be difficult because there are legitimate purposes for the use of special characters, such as within email signatures.

Barracuda researchers found that in January 2023, more than one-in-seven (15%) organisations received phishing emails that use special characters in this way, each receiving, on average, around four such emails during the month.

Commenting on the findings, Mark Lukie, Director of Solution Architects, APAC, Barracuda, said: “Phishing is a common starting point for many cyberattacks, including ransomware, financial fraud and credential theft, and cybercriminals continue to develop their phishing approaches to trap unwary recipients and avoid being spotted and blocked.”

Related article: Five emerging fraud types in APAC identified for 2023

Be the first to comment

What do you think?

This site uses Akismet to reduce spam. Learn how your comment data is processed.