Don’t Click That ZIP File! Phishers Weaponizing .ZIP Domains to Trick Victims

A
new
phishing
technique
called
“file
archiver
in
the
browser”
can
be
leveraged
to
“emulate”
a
file
archiver
software
in
a
web
browser
when
a
victim
visits
a
.ZIP
domain.

“With
this
phishing
attack,
you
simulate
a
file
archiver
software
(e.g.,
WinRAR)
in
the
browser
and
use
a
.zip
domain
to
make
it
appear
more
legitimate,”
security
researcher
mr.d0x

disclosed
last
week.

Threat
actors,
in
a
nutshell,
could
create
a
realistic-looking

phishing
landing
page
using
HTML
and
CSS
that
mimics
legitimate
file
archive
software,
and
host
it
on
a
.zip
domain,
thus
elevating

social
engineering
campaigns.

In
a
potential
attack
scenario,
a
miscreant
could
resort
to
such
trickery
to
redirect
users
to
a
credential
harvesting
page
when
a
file
“contained”
within
the
fake
ZIP
archive
is
clicked.

“Another
interesting
use
case
is
listing
a
non-executable
file
and
when
the
user
clicks
to
initiate
a
download,
it
downloads
an
executable
file,”
mr.d0x
noted.
“Let’s
say
you
have
an
‘invoice.pdf’
file.
When
a
user
clicks
on
this
file,
it
will
initiate
the
download
of
a
.exe
or
any
other
file.”

On
top
of
that,
the
search
bar
in
the
Windows
File
Explorer
can
emerge
as
a
sneaky
conduit
where
searching
for
a
non-existent
.ZIP
file
opens
it
directly
in
the
web
browser
should
the
file
name
correspond
to
a
legitimate

.zip
domain.

“This
is
perfect
for
this
scenario
since
the
user
would
be
expecting
to
see
a
ZIP
file,”
the
researcher
said.
“Once
the
user
performs
this,
it
will
auto-launch
the
.zip
domain
which
has
the
file
archive
template,
appearing
pretty
legitimate.”

The
development
comes
as
Google

rolled
out
eight
new
top-level
domains
(TLDs),
including
“.zip”
and
“.mov,”
that
have
raised
some
concerns
that
it
could

invite
phishing
and
other
types
of
online
scams.

This
is
because
.ZIP
and
.MOV
are
both
legitimate
file
extension
names,
potentially
confusing
unsuspecting
users
into
visiting
a
malicious
website
rather
than
opening
a
file
and
dupe
them
into
accidentally
downloading
malware.

“ZIP
files
are
often
used
as
part
of
the
initial
stage
of
an
attack
chain,
typically
being
downloaded
after
a
user
accesses
a
malicious
URL
or
opens
an
email
attachment,”
Trend
Micro

said.

“Beyond
ZIP
archives
being
used
as
a
payload,
it’s
also
likely
that
malicious
actors
will
use
ZIP-related
URLs
for
downloading
malware
with
the
introduction
of
the
.zip
TLD.”

While

reactions
are

decidedly
mixed
on
the
risk
posed
as
a
result
of
confusion
between
domain
names
and
file
names,
it’s
expected
to
equip
actors
acting
in
bad
faith
with
yet
another
vector
for
phishing.

The
discovery
also
comes
as
cybersecurity
company
Group-IB
said
it
detected
a
25%
surge
in
the
use
of

phishing
kits
in
2022,
identifying
3,677
unique
kits,
when
compared
to
the
preceding
year.

Of
particular
interest
is
the
uptick
in
the
trend
of
using
Telegram
to
collect
stolen
data,
almost
doubling
from
5.6%
in
2021
to
9.4%
in
2022.

That’s
not
all.
Phishing
attacks
are
also
becoming
more
sophisticated,
with
cybercriminals
increasingly
focusing
on
packing
the
kits
with
detection
evasion
capabilities
such
as
the
use
of
antibots
and
dynamic
directories.

“Phishing
operators
create
random
website
folders
that
are
only
accessible
by
the
recipient
of
a
personalized
phishing
URL
and
cannot
be
accessed
without
the
initial
link,”
the
Singapore-headquartered
firm

said.

“This
technique
allows
phishers
to
evade
detection
and
blacklisting
as
the
phishing
content
will
not
reveal
itself.”

According
to
a

new
report
from
Perception
Point,
the
number
of
advanced
phishing
attacks
attempted
by
threat
actors
in
2022
rose
356%.
The
total
number
of
attacks
increased
by
87%
over
the
course
of
the
year.

This
continued
evolution
of
phishing
schemes
is
exemplified
by
a
fresh
wave
of
attacks
that
have
been
observed
leveraging
compromised
Microsoft
365
accounts
and
restricted-permission
message
(.rpmsg)
encrypted
emails
to
harvest
users’
credentials.

“The
use
of
encrypted
.rpmsg
messages
means
that
the
phishing
content
of
the
message,
including
the
URL
links,
are
hidden
from
email
scanning
gateways,”
Trustwave
researchers
Phil
Hay
and
Rodel
Mendrez

explained.

Another
instance
highlighted
by
Proofpoint

entails
the
possible
abuse
of
legitimate
features
in
Microsoft
Teams
to
facilitate
phishing
and
malware
delivery,
including
utilizing
meeting
invites
post-compromise
by
replacing
default
URLs
with
malicious
links
via
API
calls.

“A
different
approach
that
attackers
can
utilize,
given
access
to
a
user’s
Teams
token,
is
using
Teams’
API
or
user
interface
to
weaponize
existing
links
in
sent
messages,”
the
enterprise
security
firm
noted.

“This
could
be
done
by
simply
replacing
benign
links
with
links
pointing
to
nefarious
websites
or
malicious
resources.”

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts