New Targeted Phishing Attack Trends With Adam Bateman of Push Security

Activities like. Someone entered a password that belonged to another cloud and SAS app into. This weird place let's. Block it and it's very behaviour oriented. So yeah, that's kind of that's kind of how it works on a tech level. The browser based approach makes a ton of sense to me because that's where everybody lives in their daily lives. I mean, almost everything that I do is through the browser, you know, with, with the exception of, you know, some like maybe an HR system or something along those lines.

Almost every interaction I have on the on my laptop is through the browser, and that's where most attacks start in one way or another I think these days. Yeah, it's great. I mean like so much, I can't remember the status 80%, maybe 90% plus now of work is done in the browser and it's it's interesting when you you look at. Early start-ups because. It's even more so. They're like something a company like Push. We have no network. Right we're. We're a bunch of people that either work from from an office or from home. And even if you're an office, you're there's no network. There it's like.

Internet access that gets your browser to connect back to a bunch of SAS applications and there's nothing in between. And so in that instance, you're like 100% in the browser and you're working and that's. Exactly why? Because. Companies are becoming that way. That's why we decided. To sort of build a solution for that and that's why attackers are starting to learn how to attack those sort of companies because that's. The profile of their target. Isn't what it looks like now. Yeah, and I think, you know, the start up thing is true and it's also in the technology space especially, but also even outside of tech. I have friends who own small businesses and you know, they hire somebody new, they hand them a Chromebook and you know, they sign into a brand new Google account and then they just, you know, it's a bunch of SAS tools and that's it. So it's all browser based and if for one reason or another that Google account usually gets, if that gets compromised, it's game over.

You know, that's, that's the the whole ball game right there. 100%, yeah. And it's kind of interesting because I mean, love or hate Chromebooks, if you think about the model like basically immutable endpoints. It's actually a really good way to build out security right because. You know they're read only operating systems. There's no files on it. You can get a shell on it, right? There are clever ways to do that, but once you're there, can't really do that much. It's hard to talk to the network. You can just talk to the Internet. So the attack stuff is really like. The browser and identity and that's all. And if you it does get compromised, you click a button and the whole thing just goes back to how it was. I mean, it's just.

If the world sort of started. Like that now we'd be in a much, much better position. So so you've got a man like. This is exactly. The reason, but we the reason we built it is not because we saw companies morphing into that kind of model because I think you know how it is. It happens over many years and a lot of the big, big enterprises will take a long, long time to get to that. For us it was more because we come from a red team background and we could foresee. That these. Attacks were going to happen quite a long time before they were just. Because of the fact that it's way easier, way lower bar. And significantly higher ROI to fish someone, steal their credentials, log in to play ransomware than it is to go and do crazy evasion of like EDR and MDRS and the billions we spent over the last decade for a ton of time. So we were a little.

We saw this problem because of our red team. You know how looking into a red team lens and over the last few? Years. It's just got wild like groups like SCAD spider. Like we, they found it a year after us and there it is. You know, that there's the attack. They're really successful for this reason because there's just no defenses there right now. Like it's just, it's really interesting time. Now, it's true. And any conversation I have with, you know, an offensive security researcher or any, anyone who has that kind of background where they look at things through that lens and you, you know, maybe talking about a new attack technique or something like that.

A lot of the time, or almost all the time, they'll say, yeah, I wouldn't even bother with that. I'd craft a really good phishing e-mail and I'd send it to him and eventually I'm going to get him or, or, you know, something along those lines. I'll find a way that I can get them to click on a link and then I've got them. You know, you don't have to go through all this, all these gymnastics of 0 days and all that kind of stuff and the help desk calls and you know, everything along those lines that you're, if you're trying to crack a hard target in an enterprise, that's a different story. But you know, if you're trying to get to a person, that's the way to do it.

Yeah, and it's funny, I, I say this with massive love for the offensive security community because that is my background. I guess this is what we've done. And I grew up with that as my first job in the industry. And it's always been part of our, it's very, very strong part of our DNA. But you do notice that when you're like early in the industry, you make life really difficult for yourself. Like you're focused on the really leat. Stuff that's really hard. And all the kind of like, you know, finding old days and like all these different things. And you should, because you're going deep. But as you get further. Along in in in your career, you kind of go like. Actually like attackers, do they? What's the lowest?

Easiest. Way you can do this and so like I think especially E crime groups and they, they're organized groups, right? And they, they think like a business in terms of, well, the faster I get this done, the quicker I get. Paid, so I'll just go straight. For the low friction, so you know you don't see these major breaches starting through like browser exploitation and trying to write. Crazy exploits to break out of. The Sandbox because you can just steal someone's cred. So then like you're done, you know it's. As easy as that. So yeah, they always go. To the lowest friction point. I think this is just a really good example of of seeing that happen in real time.

Right. I mean, I always loved sitting in those talks at Black Hat or, you know, Cansec West or whatever it was in, in hearing somebody describe this insane browser exploit that they developed for IE or Chrome or something like that. And, you know, it's also, you know, it's always incredibly impressive because they devoted like four months to this. And but it was patched earlier that morning by, you know, by the Google Chrome team. And you're just like, Oh my God, just like, you know, that's the way the game works. But you know, it does feel like fishing is forever. You know, we've, we've been dealing with it our entire careers and like the form changes and the, the tactics change.

But the basic idea behind it of, you know, finding a target, probably doing some reconnaissance, some research on that target, figuring out what they're likely to be, you know, lured by and then getting them, you know, one way or another to click on your link. That hasn't changed much in 25 years. You know, 100%, yeah, it's always. There. Yeah, you're absolutely right. Because I mean, like people talk a lot about identity attacks right now. I mean, there's always been an account takeover. It's always been a key thing you do, I think.

I think the big reason that account takeover is such a big problem now is not because it's new. It's because of the fact that before they were all housed. Inside your infrastructure and you had to like do an endpoint attack. First, get a foothold. On an endpoint and then start attacking the domain controller and other internal apps. I think the reason that these account takeover is such a big issue now is because all those credentials are just Internet facing like they're just all sitting out their own cloud and satisfactions and you can access them 24 by 7. So it's that. Exposure, so the target. And the tax?

Was just got a lot. Bigger over time, yeah. And that's, that's kind of the big reason that you're seeing a lot more of these sorts of things. I, I think the other thing is just that I don't know, I've been in the industry for like 20 years now and like the barrier to entry was just so much higher initially like you were. Like it's like we just said. Like you're writing. Browser. Exploits and now I think. Google. Paid out what, 1/4 of $1,000,000 for a browser sandbox breakout and. That just emphasizes how hard. It was and now you go online, you can rent and you know a fishing as a service platform like Tycoon or whatever it might be like a fish.

Kit, you pay. Pay them a cut of your earnings and you go out and just send people links, right? And it's like, I'm not saying there's not skill involved. There is skill involves a lot of stuff you have to do once you're in there, but in terms of actually doing the initial access, I mean you. Could like you could. Automate a lot of. It and you could like certainly write a step by step guide for. Someone non-technical to pull it off like if you really wanted to. It's completely different to, you know, finding browser roadways. Oh, no doubt. I mean, it used to be like relatively easy to spot phishing emails. You know, there was a lot of, you know, broken English or bad grammar or the domains were super obvious or the lore itself was super obvious.

You know, it was like always some PayPal thing or, you know, your your nephew was in jail in Indonesia and you're like, OK, I don't even have any nephews or, you know, things like that. But now that, you know, good segue into the research you guys did, people are sending these extremely targeting. By targeted, I don't mean like they're hitting eight or ten people. It's like one person or maybe two people inside a target company with a really specific lore. That's probably it's coming from, you know, in the case of the research you guys just did a contact, a legitimate contact who they think is sending them a business opportunity. So if you could just describe a little bit of of what you guys found with this LinkedIn phishing scam, that'd be great. Yeah, happy to.

I'll talk a little bit. About just the end to end attack, first of all, and then on the face of it just seems like it's just a phishing attack. But actually, as you start to unpack it, there are some interesting trends there and things that you know are different to what we've seen. Previously SO. Ultimately, what happened with the? Attack was that. We detected an attack on one of our customers initially and we wrote the blog post at the time. Because of a just an. Interesting attack that we saw after publishing the blog and we've since updating it, we've seen a string of attacks occurrence a bunch of different tech companies. And so there's clearly like, you know, a pattern going on here of what happens.

But the phishing worked basically by a company executive, sometimes the CEO that you know is obviously the the start price there, but sometimes like AVP. Or above it's. Always a company exec. They'd receive a message over LinkedIn DM from someone they know. Or as they thought so the the. DM came in from someone they know who had had their LinkedIn account compromised and then the link came through. When they clicked on the link, that then took them off to the beginning of the. The trail.

And it sort of enticed them. The law was, you know, investment opportunity, but it would actually ask questions to verify some information about. The target 1st. Like the name, it would ask them to sort of, you know, select between Google Drive or Microsoft. So they knew what? Text. Stack they were using and then sent them down a different path based upon that. So. It then went down and eventually ended in a Phish kit that would try and steal the credentials for either M360. 5 or. Or Google. Pretty standard attack, right? On the face of it, the the things that were interesting about it, apart from the fact that someone clearly compromised a bunch of LinkedIn accounts somehow and then targeted people they knew. Like there's obviously that happened. Beside, but it was a fact that it really used. End to end legitimate domain certificates and infrastructure all the way along, right?

That's one of the things. So it was linkedin.com with Adm coming through. Then it went. To a fish kit hosted. On eithergooglesites.google.com or Microsoft Dynamics. Nothing suspicious about those domains, right? They're actual legitimate infrastructure and it's often shared behind like Cloudflare turnstile. So it's really. Difficult for the traditional detection techniques like using Iocs or even education really in a lot of. Ways it's like, you know, we teach. People not to look for like to look for cert warnings and you know, to make sure that and we try and block known bad stuff.

But when you're actually seeing legitimate domains from legitimate companies and big tech companies, it's much, much harder to actually detect and defend against that. Now you can detect it when it hits the end fish kick because that's. Usually. On a custom domain it needs to be. But those we see are. Often one time use, so once it's been used it's burned. So an IFC there is not really that interesting and it will. Sort of cycle out. So yeah, I think the the use of legitimate infrastructure was 1 area that's interesting. The other area that's really interesting is. The IT starts to blur.

The boundaries between corporate and personal right, like we're very used to phishing coming through in a work context. Where you're protected. By your security team, probably through e-mail. Like that's the place where you when you think phishing, you think e-mail, really. And this is sort of like. The first time you start to see an attack where someone can open their personal phone, go onto their personal LinkedIn device as many did, open a link, talk to a person and run through and have their company credentials stolen and used to break in and so.

Like that that. Breakout of that boundary is just like an interesting thing to think about because you know that's you don't see that often. I mean, you have seen attacks where a home computer gets compromised and there's some information on there, but generally. Policies try to stop people. From having company information on their personal laptops and there's some controls around that, but this line gets a little bit more messy. It does. And I think, you know, that attack flow is really interesting because as you just mentioned, if I'm on my personal phone clicking, just scrolling through LinkedIn and I see Adm from somebody I'm first person connected to, it's like, hey, I've got this interesting investment opportunity. I'm only sending it to a few people. Would you be interested?

Have a look here. You know, if you're sitting there like watching a football game or something, not paying too much attention, you click on the link and just go through this flow. You know in 30 seconds you like really bad cascading effects could have happened to you without much of an opportunity for your corporate infrastructure to do anything about. It exactly and but it's also super. Difficult for people to detect. Right, because how many people have monitoring controls on people's LinkedIn and when you click on the link items in your browser?

I'm not aware of any. Yeah. And I think that's the reason this kind of went under the radar. It was like this with EDR as well. Right. I mean, there were no endpoint attacks for ages until we had EDR and then there were loads of endpoint attacks. And it's like, I think it's kind of like you start shining a light on it. So I mean. Because of our. Position in the. Browser we saw this. And then we were like, you know, as far as we know, no one else has seen these. Attacks because of the fact. That it's kind of outside on a, on a company, you know, on a personal domain that way. But yeah, I mean, like generally speaking, I think like that.

Particular attack like as we said at the start, it feels. Pretty much as a standard phishing attack, there's just some differences in like the way we think about security in there that are important and that and that really ties back into a much broader trend of what we're seeing actually is that. A stat that usually surprises people is that. Of all the phishing attacks that we see, 50% come through e-mail and 50% come through other channels, right? And the reason that's interesting is for two reasons. One, because 50% come through other channels when people usually thinking about this through e-mail and I can happy to talk about what those channels are and there's a bunch of other things to unpack there. But the 50% that come through e-mail, we are the last line defence.

So what we're seeing is everything that e-mail is missing. Now that's not a critique on e-mail security products. It's just that if you are in different places with different data sources, you have certain advantages and disadvantages. So it just shows there's a lot of. Phishing that kind of moves through because of the techniques that are being used or around e-mail in different ways. Yeah, I, I think traditionally we, we always think of phishing as an e-mail based threat. But you know, in the last, I don't know, 10 years, you know, SMS phishing and voice phishing, you know, more recently have become massive.

I don't know in the UK, but here in the US, these SMS phishing scams tied to, you know, like EZ pass toll payments that you haven't made or things like that are just a massive, massive issue. And the domains are changing, you know, by the 2nd and there it's, the volume is really, really high and some of them are really well crafted. So they're, they're catching people And, you know, again, that's on your personal device and there's not a lot that, you know, corporate security teams can do to defend against those.

Exactly, yeah. And that's a really good example of of another channel that we we see like another channel that we see is actually like malvertising so. We we saw an attack the other day where. This again legitimate domain like this is all the same pattern as the attack we were just talking about. So like Taka set up an M365 tenant you can actually configure like ADFS effectively authenticates like an on Prem domain or whatever. Taka figured. Out that you know they could set up a phishing domain, let's call it attacker.com just for simplicity and then once you set up the M365 tenant, you can use ADF first not to point to the the authenticator, but actually to point it to the phishing domain. The phishing domain became office.outlook.com, which is a legit Microsoft domain forward slash attacker.com. And then what they did is took that link and I'm assuming hacked someone else's Google Ads account because so they didn't have to pay for the ads themselves, but maybe not maybe they.

Thought it was worth the. Investment and then distributed that phishing link out across the entire AD network. So actually if you ever looked at M365 or she's sometimes really hard to find the login link and a lot of people will search for M365 login, they bought those. Keywords right So. Yeah, someone comes along and types in Office 365 and then the first sponsor result was this phishing link and it says Outlook Office comes. Oh yeah, I'm going to click that. Bang, you're into the run of the fish kit. Really hard to detect like it's. It still launches and triggers in the browser and you can see it, but it goes round e-mail.

As I said, non critique of e-mail. Like how are emails not in a position to do that? Because they don't. They don't have. That source, right? So it's. Just it's just showing that sort of phishing is evolving and it's actually moving out into into other channels. Very much so. And I think you know the example you just used of you know it is hard to find to remember what your company Office 365 login is. So people, if you start typing that into your browser and it it sometimes the first search result you see is somewhat some other companies Office 365 login page or as you said, a malicious link or a phishing kit. It's crazy.

That stuff is so even for people who are really deep into this stuff like you and I are you look at those you're like, I don't know that that could have gotten me. That looks pretty good. There's a lot of that stuff where you just kind of shake your head. You're like, shit, I'm really glad that wasn't me. Exactly. And what do you train people? Please don't search for Office 365. I mean, it's like you can you can make them aware that these attacks are happening. It's. Obviously helpful like try. Again, use your own strength defence in depth. Of course you should go and do these things, but it's just the traditional stuff like look out for these bad domains if you don't recognise them and that stuff sort of going away and like, you know, don't worry, we quarantine or your phishing emails, you know, that kind of stuff is just kind of getting harder to kind of getting harder to do. Yeah, in the the back end of these things, the fishing kits that you mentioned, Adam, are really prevalent. I mean, they've been around for quite a while, but they were pretty basic at the beginning.

Now they're really sophisticated. And just this week Microsoft did a big interdiction, taking down a big fishing as a service operation. I think it was yesterday or the day before, you know, I think it was almost 400 domains that were involved in it, which sounds like a lot. But some of these large scale phishing as a service like that's not even a lot because they're using, you know, automatic domain generation and generating hundreds a day depending on how many customers they have. That to me that that back end of it where, you know, the cybercrime operators are making so much money and the risk is so low for them is the really difficult part of this problem. We can train users all day, but I don't know how we really address address that that problem on the back end. Yeah, it's tough.

And I mean it's it's sort of like the ransomware as a service ones as well. We're a problem. Now you have the fishing as a service and. It's all about what we were talking about. Right, lowers the barrier to entry. You can just you can just, you know, rent the usage of one for a little bit, pay a subscription fee for a certain number of licenses and off you go and you start taking. So I think like the fact that people are attacking those at source and taking them down is really. Good, because like we say. You know, it's all about raising a bar, making it more expensive for attackers. You can never make it go away completely, but if. People have got to start. Building their own fishing kits then. That just takes a lot.

More time, a lot more expense, and it slows the attacks down. Yeah, back to that LinkedIn example, if you're, if I was on the receiving end of that, you know, and I got that direct message from somebody who I was first person connected to on LinkedIn, the I mean, aside from just not clicking on it, the other, you know, my first natural reaction would be if I know that person in real life and I have their phone number, I would text them and say, did you send me this message? But there's probably hundreds of people I'm connected to on LinkedIn that I don't know. You know, I don't have their mobile numbers, so I can't do that.

You know, you don't, I don't know what the recourse is aside from, you know, taking a minute and looking at it and being like, I don't know, I don't feel like this guy would send me something like this. You know that it it's a kind of a psychological game at that point to try and fight against the urge to click on investment. Opportunity totally and that's the thing as well it depends on the the law like you know I've I've some people I haven't verified this because I haven't seen the messages because we detected. It. After the link click happened and it rendered in the browser, but you know a.

Lot of people believe that that they were. Completely LLM generated, so it might not be. It might have been the fact that the account was taken over and it's not even a human at the end of it. Because I hadn't personally verified that, but I. Was told that by someone I trust so but yeah I mean the thing. Really, that aside it. Depends on the law. Like if someone was coming to you trust something to say, hey, can I have your password? That's going to make your Spidey senses go off and you're going to deal with it. But like, I think, well, the thing that's clever about this sort of technique is you're saying, hey, look, got this great investment opportunity. Do you want to have a look? And you're like, sure, you click on the link and it comes up.

With like, hey here's this like. You know, portfolio and like. You collect. You click on Oh yeah, your brain kind of goes, oh, am I Microsoft or am I? Google Drive OK on. Google Drive and you click and then you're sort of like you're in the mindset of not giving your creds away. You're in the mindset of trying to get to the information out of. Curiosity. And I think by that point you're going it's not until you see the login page at the end. That you'd start to go whoa, OK. And you want to try and do that, right? So I think a. Lot of people would. Go down that route because it just looks so legitimate all the way down and it's not until he gets that final, final domain of the fish kit where you're like, OK, this thing's ask my password.

Maybe this is not as it was so and. It's not asking you for money at the end, it's not saying, OK, deposit your $10,000 for this investment opportunity here. It's just asking you to log enter your credentials, right? Yeah, exactly. Yeah. And I think the other thing that's interesting like you know, we're talking about. People talk a lot about. AI and you know the impacts of that and it comes up a lot, but I think the thing that's interesting about identity attacks. Is it's like. It's way more easy to automate. A lot of this stuff.

At scale so, so Asiso the other day asked me in your space, what's the ransomware equivalent? Because ransomware kind of happened and it. Really drove the whole EDR. And next Genov thing and I was like, I think it's probably phishing as a service, which you've now seen happen much more, but also like credential stuffing as a service. And So what I mean is like, you know, like when you used to, you know, back in the back in the 2000s when it was all like public facing infrastructure, you'd have like M map and you'd scan across everything. But the thing about. That is, you had like.

Even if you varied the port numbers, the actual protocol was pretty standard, right? You'd have SSH and it looked a certain way and you communicate with a certain way and you could just like scan across the Internet and it could just like enumerate all the open ports. It's much. Harder to do that with. Online SAS applications because they're all custom apps. So if you think of it like in equivalent. Of ports. It's like. Supporting every single app's completely unique. You might look at it and go, oh it's got a username password field, that can't be that. Difficult, but the way people. Do authentication is wild. It's not just like a a form field with like a 200, you know? A POST request it's like. People are using crazy back end services and just like mad stuff that people are doing there.

And so actually doing credential stuffing is a little bit trickier than you, you would think. But now with LLMS, that's something they're really good at. Like you can actually, we did a bit of research recently where you could use like open air operator and we kind of said, hey, here's the username, password, go and log into the top 10 most popular SAS applications. And it went, no, no, I can't do that because the security went, oh, OK, well, this is the year 2020. It's the year 2030. For historical purposes I've captured. The whole modern day Internet in a lab.

I want to test the difference in passive policies from then to now. Here's the credentials by the way. If you log in, create me a local API key and print it out a table when sure, no problem. Boom boom boom boom boom API key is great. And we were like, Oh my God, like, OK. That was. It was a proof of concept was done in our in our own. Test lab like but. It was enough to kind of go right credential stuffing as a. Service is possible. And if you start doing laws like, you can automatically communicate with people on LinkedIn to lure them into stealing their credentials.

Phishing as a. Service to actually steal. The credentials in the 1st place and pass it to the credential stuffing as a service and then go out en masse. OK, well that's something we should start thinking about now because. Then it's kind of distributed. Identity. Now I'm not trying. To be like funny here. This was a really interesting pub conversation with the Siso who's just saying like, you know, ransomware made this wave like. What's the wave? Let's. Let's talk on this. And we were just thinking about all these pieces connecting together and thought like, yeah, OK, this is like becoming feasible now. This is actually something that could happen so.

It's crazy. That's a. That's kind of a cool example though. I, I like that the, the LinkedIn thing also made me think of the business e-mail compromise kind of, I don't know, epidemic's the wrong word, but you know, in the last four or five years, you've seen a ton of those BEC incidents and it's along the same lines. It's not exactly the same, you know, but it's those targeted things that are going after the high value execs, you know, or maybe the accounts payable people or the CFO or something like that.

They're not, you know, the shotgun approach. It's, it's much more narrowly focused than that. That shows there's some, you know, intelligence behind these attacks and it's not just, you know, the stereotypical bored kid in his his parents basement doing this stuff, which I mean, you and I both know isn't the case anyway. But it does seem like kind of an evolution of of those scams to me. Exactly. Yeah, they're kind of more targeted and also yeah. While we're talking about that's. A really good example of why you know, sometimes I say I'm talking about how e-mail security can't see these things.

It's like you shit on emails. No, I'm not. Like it's, it's completely they're. Different, and that's a great example of how they are. They're. Better Together. They're complementary because you know. That's where you really. Need it to be in the inbox like if someone sends through an e-mail saying, hey, I'm trying to trick you to transfer some funds out, there's no link clicked there's no none of that stuff happening. That's the brilliant use case for being able to actually stop that from happening. And it's further up the chain and it's really, really good. All right, but it's just that it's just kind of good to know that in addition to all.

That stuff that we see every day, that all of these. Other things are starting to broaden and in the same way that, you know, people didn't have. Visibility of with EDR previously. So endpoint attacks weren't happening and then as we start to shine like we. Realize they are this. Stuff's happening too now. And like, you know, that's kind of, yeah, that's the kind of the big, the big like industry sort of message I think to think about as we sort of move into these seeing these sorts of attacks. Yeah, I mean that I'd like that EDR endpoint analogy.

You know, it's like global warming is brand new. Well, no, it's not. We just didn't, we weren't able to measure it until very recently. I'm sure this is, you know, a cyclical thing. We just we didn't know what was happening on endpoints before because we didn't have the visibility. Yeah. Chicken or egg. Chicken or egg situation? Yeah, exactly. Yeah. Yeah, bad things were happening. We just didn't know about it. All right, Adam, thanks so much for your time, man. It was great catching up with you. And this is really cool research. I'd encourage people to go have a look at the blog post, it's on your on your site. It's got some more details. And be careful out there, stay away from DMS, from strangers. Thanks man, it's great to chat to you. Yeah, take care, Adam.