Full Report
To stay ahead of evolving threats, LevelBlue utilizes a machine-learning-based URL scanner that constantly evaluates the digital landscape. We closely monitor VirusTotal for instances where LevelBlue acts as the sole detection layer — a crucial tactic for spotting new phishing campaigns early. In this blog, we will unpack several notable phishing campaigns discovered through this method.
Analysis Summary
# Tool/Technique: Multi-Stage Phishing Redirection Chains
## Overview
This technique involves the use of "Infrastructure Relays," where attackers utilize multiple layers of redirection to deliver phishing content. By abusing trusted no-code platforms, cloud services, and newly registered domains (NRDs), threat actors obscure the final destination from automated scanners and security filters.
## Technical Details
- **Type:** Phishing Technique / Redirection Chain
- **Platform:** Web-based (Cross-platform)
- **Capabilities:** Multi-stage redirection, brand impersonation, anti-debugging, credential harvesting.
- **First Seen:** Reported August 2024 (LevelBlue Labs)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0005 - Defense Evasion]**
- [T1564.010 - Hide Artifacts: HTML Smuggling]
- [T1583.001 - Acquire Infrastructure: Domains]
- [T1620 - Reflective Code Loading] (via Blob API)
- **[TA0006 - Credential Access]**
- [T1557 - Adversary-in-the-Middle] (Device Code Phishing)
## Functionality
### Core Capabilities
- **Infrastructure Abuse:** Leverages legitimate services like Framer (no-code web builder) and Cloudflare Workers to host initial lures.
- **Dynamic Redirection:** Uses buttons and script-based triggers to route victims through intermediary domains.
- **Brand Impersonation:** Uses "Secure Document," "Shared Proposal," or Google Sign-In lures to establish trust.
- **Automated Traffic Filtering:** Employs custom CAPTCHA challenges to block security bots and researchers from reaching the final payload.
### Advanced Features
- **Anti-Debugging Logic:** JavaScript checks that detect and block common keyboard shortcuts for browser Developer Tools.
- **HTML Redirection Smuggling:** Implementation of the HTML5 Blob API to store and execute decrypted data locally in the browser memory, bypassing network-layer inspection.
- **Web Crypto API:** Use of `crypto.subtle.decrypt` to decrypt malicious strings at runtime, preventing static analysis of the source code.
- **Device Code Phishing:** Integration of Microsoft Device Code flows to bypass Multi-Factor Authentication (MFA).
## Indicators of Compromise
- **File Hashes:** N/A (Web-based campaign)
- **File Names:** N/A
- **Registry Keys:** N/A
- **Network Indicators:**
- hxxps://logangrowthadvisors-rfp-centre[.]framer[.]website/
- hxxps://stored-plans-hlei[.]w-y9a826[.]workers[.]dev/
- hxxp://2934523t5234535323973294afhdsfga[.]com
- hxxps://bl[.]dase7[.]shop/
- hxxps://alasilla[.]com/frontdeskformationdocusignpaywet/
- **Behavioral Indicators:**
- Redirection from no-code platforms (Framer, Wix) to Cloudflare Workers.
- Presence of `Blob()` or `URL.createObjectURL()` in suspicious HTML lures.
- Use of Web Crypto API for string decryption in landing pages.
## Associated Threat Actors
- Unknown (General phishing infrastructure typically used by various financially motivated groups).
## Detection Methods
- **Behavioral Detection:** Monitor for "Newly Registered Domains" (NRDs) that immediately request credential input or utilize device code flows.
- **Signature-based Detection:** Inspecting for specific JavaScript functions related to anti-debugging (e.g., blocking `Ctrl+Shift+I`).
- **AI-Based Scanning:** Utilizing machine-learning URL scanners capable of evaluating multi-stage redirection logic and DOM changes.
## Mitigation Strategies
- **Prevention Measures:** Implement Email Security Gateways (ESG) that perform deep link analysis and sandboxing.
- **Hardening:** Use FIDO2/WebAuthn-based MFA to mitigate the risk of Device Code phishing and session hijacking.
- **User Awareness:** Educate users on the risks of "Secure Document" lures originating from unusual third-party cloud domains.
## Related Tools/Techniques
- **HTML Smuggling:** Often used in tandem to deliver malware payloads (e.g., Qakbot, IcedID).
- **AiTM (Adversary-in-the-Middle):** Used to intercept session cookies in real-time during the phishing process.