June 4, 2023

New BEC cyberattacks use phishing with a reliable Dropbox hyperlink as a lure for malware and credentials theft.

This illustration shows a lock, unlocked over a person at a keyboard.
Picture: Adobe Inventory.

Risk actors have added a brand new wrinkle to conventional enterprise electronic mail compromise cyberattacks. Name it BEC 3.0 — phishing assaults that bury the hook in reliable internet companies like Dropbox.

Avanan, a unit of Verify Level Software program, has tracked a latest instance of this assault household, during which hackers created free Dropbox accounts to seize credentials or conceal malware in legitimate-looking, contextually related paperwork comparable to potential staff’ resumes.

The assault, the safety agency found, began with the actors sharing a PDF of somebody’s resume through Dropbox. The goal can’t view the doc except they Add To Dropbox. The hyperlink from Dropbox regarded reliable, making the exploit tougher to identify.

The phishing exploit includes these steps:

  • First, a consumer clicks the hyperlink in a reliable notification from Dropbox to a resume and accesses a web page hosted on the file-sharing service.
  • The consumer should then enter their electronic mail account and password to view the doc. Because of this the menace actors have entry to electronic mail addresses and passwords.

On this web page hosted on Dropbox, customers are requested to enter their electronic mail account and password to view the doc, giving menace actors consumer credentials.

As soon as a consumer enters their credentials, they’re directed to a pretend Microsoft OneDrive hyperlink. By clicking on the hyperlink, customers are given a malicious obtain.

“We’ve seen hackers do a whole lot of BEC assaults,” Jeremy Fuchs, a cybersecurity researcher/analyst at Avanan, mentioned in a report on the assault. “These assaults have a number of variations, however usually they attempt to spoof an government or companion to get an finish consumer to do one thing they don’t need to do (like pay an bill to the mistaken place),” he mentioned.

SEE: One other hide-the-malware assault focuses on DNS (TechRepublic)

“Leveraging reliable web sites to host malicious content material is a surefire solution to get into the inbox,” he mentioned. “Most safety companies will take a look at the sender — on this case, Dropbox — and see that it’s reliable and settle for the message. That’s as a result of it’s reliable,” he added.

Avanan mentioned stopping these stealth assaults requires a lot of defensive steps, together with scanning for malicious recordsdata in Dropbox and hyperlinks in paperwork, in addition to changing hyperlinks within the electronic mail physique and inside attachments. The important thing to schooling towards these social engineering assaults is context, based on Fuchs: “Are resumes sometimes despatched through Dropbox? If not, it might be a cause to contact the unique sender and double-check. If they’re, take it one step additional. Once you log into Dropbox, do I’ve to log in once more with my electronic mail?”

Avanan mentioned the researchers reached out to Dropbox on Could 15 to tell them of this assault and analysis.

Linktree additionally used to seize credentials

Earlier this month, Avanan found an analogous hack utilizing the social media reference touchdown web page Linktree, which is hosted on websites like Instagram and TikTok. Much like the Dropbox assaults, hackers created reliable Linktree pages to host malicious URLs to reap credentials.

The attackers despatched targets spoofed Microsoft OneDrive or SharePoint notifications {that a} file has been shared with them, instructing them to open the file, based on Avanan. Finally, the consumer is redirected to a pretend Workplace 365 login web page, the place they’re requested to enter their credentials, the place their credentials are stolen.

“[Users] ought to suppose: Why would this particular person ship me a doc through Linktree? Most probably, that wouldn’t be the case. That’s all part of safety consciousness — understanding if an electronic mail or course of appears logical,” mentioned Fuchs.

In these circumstances, the agency means that recipients:

  • All the time examine the sender’s tackle earlier than replying to an electronic mail.
  • Cease and suppose if the medium getting used to ship a file is typical.
  • When logging right into a web page, double-check the URL to see if it’s Microsoft or one other reliable website.

BEC assaults utilizing reliable websites could escalate this 12 months

Fuchs mentioned there are not any apparent visible cues to tip off assault recipients to BEC exploits. “Though when you had been to signal into the Dropbox web page, you’d see that there’s a OneDrive emblem and hyperlink,” he mentioned. “Eagle-eyed customers ought to discover that discrepancy and suppose—why would there be two competing companies on one web page?,” he added.

He predicted that these assaults will escalate. “Any widespread service that’s legit can probably be used as a car to ship such a malicious exercise. That’s why we count on it to take off within the close to future,” he mentioned, including that the exploit has been used tens of hundreds of occasions. “We imagine it will actually take off in quantity within the second half of the 12 months,” he mentioned.