Why Me? - Target Of Phishing Attacks
What’s on this page
Introduction
Businesses around the world might differ in operating industry, sector, and geographic location. However, almost all businesses are united in the suffering of phishing attacks targeting their users. Such attacks could be easy to spot by tech-savvy users. Nevertheless, a sophisticated phishing attack could even trick trained users, posing a critical threat and forming a great chance for threat actors to achieve their goals. Moreover, one of the most interesting elements is the variation of the targets, as some users were observed to receive a large volume of phishing emails, while others are receiving a relatively less amount. This advisory aims to uncover the most used techniques by threat actors to obtain the email addresses of the organization’s users to initiate the phishing campaign.
Sources of Email Addresses
Publicly Exposed Accounts
In this case, the threat actors attempt to obtain the email addresses of the users belonging to the targeted entities by searching for any mailboxes associated with the entity's domain in search engines, public resources, and deep web resources such as paste sites. Users in many cases are unintentionally exposing their business emails in LinkedIn or Github accounts as a communication means. However, threat actors will always take advantage of such exposed details to target the users. Additionally, organizations should abstain from publishing content that contains users’ email addresses. The email addresses that can be published are the generic accounts that represent organization departments such as info, HR, marketing, and legal mailboxes.
B2B Directory
A B2B business directory is basically an online directory that is listing businesses around the world, categorizing businesses, and collecting their contact details; aiming to guide users and help them in their search for companies for marketing/business purposes. However, services such RocketReach, Zoominfo, Apollo, Hunter, and SignalHire are truly a goldmine for malicious actors to obtain a user's contact details. These online databases of businesses have their own methodologies for obtaining, verifying, and then selling the employees’ contact details of an entity. B2B directories provide such information for business purposes; hence, most of them also provide a “removal request” feature in their platform so the targeted entity will be allowed to contact them in order to remove their own data from the B2B Directory platform. In the Appendix, we have listed the most common B2B Directory platforms along with their contact details to request the removal of the organization’s details.
Email Syntax Guessing
In this case, the attacker is capable of guessing multiple user mailboxes, either by searching for the email format used by a specific entity or by guessing the generic department's mail lists, such as Public Relations, IT Department, or HR. In this case, the threat actor is not looking for a specific email account; instead, the goal here is to identify the email format being adopted by an organization. Then, the threat actor will work on identifying the employee’s names from public sources such as LinkedIn and map the employee’s name to the organization’s email format. For example, the threat actor was able to identify that the email format followed by XYZ organization is “{First Initial}.{Last Name}@xyz.com”. Then, by exploring the LinkedIn page of XYZ organization, the actor was able to find an employee with the name “John Smith”. Therefore, the threat actor will attempt to target this specific user by sending the phishing email to the mailbox “jsmith@xyz.com” which will likely be a valid email address for the user.
Third-Party Data Breaches
Data breaches are the leakage of an organization's sensitive information, including the Personally Identifiable Information (PII) related to the organization’s users or customers. The breached information is not limited in most cases to email addresses or passwords. Breaches can include the exposure of dates of birth, geographic locations, names, employer name, gender, and phone numbers. Once a third-party entity - such as social media or any service provider - is breached, the malicious actor will tend to sell the data to the public. Such data exposure represents a great source of information for threat actors as for sure some information of the organization's employees will be part of such breaches due to the registration in the breached party. By acquiring the dumps of data breaches and looking for the details associated with the users belonging to the targeted entity, this method can be utilized by the attackers to perform more sophisticated attacks. Users that are using their corporate email accounts for the registration of third-party services are for sure highly vulnerable to this type of information exposure.
Phenomenon: Targeting Personal Inboxes With CxO Name
CTM360 witnessed an increase in a sophisticated attack willing to lure the victims by delivering the phishing email to the victim’s personal inbox. Hence, the victim would be in a tough situation where he might be in a direct encounter with the threat actor; far away from the corporate defenses. The attack scheme is mostly utilizing compromised mailboxes from well-reputed email providers, using a C-level executive name as a sender, and requesting urgent action to be performed from the victim. Such details are actually aligned with the scope of advisory, where the attacker is taking advantage of the exposed details in data breaches, which includes useful information such as email addresses, job titles, employers, names, phone numbers, and social media profiles. Then, the attacker is mapping and correlating these exposed details to the victim profile of the targeted entity and initiates the Phishing attack targeting the victim’s personal mailbox.
Recommendations
In order to protect your organization from email exposure, the following steps are recommended to be taken:
- Ask your employees to remove their business account details if it was published online.
- Reach out to the B2B directories listing your users requesting the removal of the accounts.
- Use generic mailboxes in your online publications such as HR, Marketing, or Legal.
- Ensure to have a strict policy regarding the registration in online third-party services.
- Ensure not to use the same email address pattern across the organization. Use different email patterns such as:
- {LastName}@xyz.com
- {First_Initail}{LastName}@xyz.com
- {FirstName}{LastName}@xyz.com
- {LastName}{First_Initial}{Middle_Initial}@xyz.com
Appendix
Recent Blogs
TRAP10 Mini App Scam
Overview:
CTM360 has discovered a new variation of scam tactics using Telegram Mini Apps and social media ads in a Ponzi-style scheme. Scammers impersonate financial institutions, leveraging Meta Ads, Telegram Ads, and fake social media accounts to lure victims into fraudulent investment platforms.
These platforms, embedded within Telegram, present a polished interface that mimics legitimate trading sites. Victims are enticed with promises of high returns, referral bonuses, and exclusive investment opportunities. Once inside, they are encouraged to deposit cryptocurrency, believing they are engaging in real trading. However, withdrawals are consistently blocked when users attempt to cash out.
CTM360 Observations
Resource Development
Telegram Mini App
- A Mini App in Telegram is a lightweight web application that runs within the Telegram interface, allowing users to interact with services like payments, games, or trading platforms without leaving the app.
- Scammers embed these fake websites inside Telegram Mini Apps, making them accessible within Telegram itself.
- Users interact with the fake platform through Telegram bots keeping them within the scam ecosystem.
Scammers also create fake websites with dedicated domains that mimic real platforms, solely for fraudulent trading, deposits, and referral scams.
Trigger
Scammers lure victims with false promises of high, risk-free returns, financial incentives like bonuses and referral rewards, and fake branding to appear credible. They create urgency with limited-time offers and countdowns to pressure quick investments.
Distribution
Scammers spread the fraud across multiple platforms:
- Meta & Telegram Ads – Paid ads and channels drive users to fake trading platforms.
- Telegram Bots & Channels – Used to lure victims into scam sites and mini-apps.
- Social Media & Messaging Apps – Victims unknowingly spread the scam by inviting friends for bonuses.
By using ads, fake profiles, and victim referrals, scammers rapidly expand their reach.
Target Interaction
Impersonated and Bogus Profiles
- Fake social media accounts are created to promote, manage and provide fake customer service to the victims
- We have also noticed scammers impersonating financial institutions, investment platforms and other industry organizations on Telegram to lure victims.
Impersonated or Bogus Websites embedded within Telegram Mini App
- The scam operates within a Telegram Mini App, where victims are redirected to the fake investment website.
- The Mini App will retrieve victim’s Telegram details and allow them quick access on these fake websites without sign-up.
- Upon sign-up, victims are requested to deposit funds and trade but withdrawals are blocked.
Motive
- PII Harvesting – Scammers collects your email address, phone number, Telegram IDs during the sign up process.
Monetization
- Payments to Cryptocurrency Wallets – Victims are tricked into transferring funds via cryptocurrency (e.g., USDT, BNB, TRX) to scam-controlled wallets.
- Selling Data on the Dark Web – The stolen credentials, Telegram IDs, emails, and phone numbers can likely be sold on underground forums or leveraged for future cyber criminal activities
Recommendations
For Individuals:
- Avoid Telegram Mini Apps for Trading – Scammers use them to bypass security measures.
- Verify Websites & Domains – Always check official sources before engaging in financial transactions.
- Use 2FA on All Accounts – Protect Telegram and crypto wallets from unauthorized access.
- Never transfer funds to an account without verifying the purpose and recipient independently.
For Businesses:
- Scan social media, Telegram, and ad networks for scams related to your brand and report them accordingly.
- Work with platforms to remove and takedown fraudulent sites.
- Educate and warn users on common fraud schemes.
Disclaimer
The information contained in this document is meant to provide general guidance and brief information to the intended recipient pertaining to the incident and recommended action. Therefore, this information is provided "as is" without warranties of any kind, express or implied, including accuracy, timeliness, and completeness. Consequently, under NO condition shall CTM360®, its related partners, directors, principals, agents, or employees be liable for any direct, indirect, accidental, special, exemplary, punitive, consequential, or other damages or claims whatsoever including, but not limited to: loss of data, loss in profits/business, network disruption…etc., arising out of or in connection with this advisory.
For more information:
Email: monitor@ctm360.com Tel: (+973) 77 360 360
Securing Browsing Extensions
Summary:
In December 2024, hackers compromised at least 35 Google Chrome extensions, affecting approximately 2.6 million users. The attack exploited phishing emails sent to developers, masquerading as Google policy violation notices. These emails tricked developers into granting permissions to a malicious OAuth application named
“Privacy Policy Extension.
” Once authorized, the attackers gained control over the extensions, injecting malicious code to steal user data, particularly targeting Facebook credentials and business accounts. Browser extensions can significantly enhance productivity by adding new features to web browsers like Microsoft Edge and Google Chrome. However, they also pose significant security risks, as malicious or compromised extensions can lead to data breaches, malware infections, and unauthorized access to corporate networks. It is crucial for organizations to control, block, or manage browser extensions to minimize security risks, particularly in an enterprise environment. This advisory outlines the steps to block and protect browser extensions for Microsoft Edge and Google Chrome, and it also includes specific guidance on managing extensions using Microsoft Intune.
Risks Associated With Browser Extensions
● Data Exposure: Some extensions can access sensitive data (e.g., browsing history, credentials, and files), potentially exposing confidential information.
● Malicious Extensions: Cybercriminals can create or compromise extensions, making them a vector for malware distribution or data exfiltration.
● Phishing Risks: Extensions may manipulate web content, tricking users into providing sensitive information.
● Performance Degradation: Some poorly coded extensions can slow down browsers or degrade system performance.
Managing Browser Extensions Using Group Policy
A. Microsoft Edge
Using Group Policy (Windows)
1. Open the Group Policy Management Console (GPMC).
2. Navigate to: Computer Configuration > Administrative Templates > Microsoft Edge > Extensions
3. Set the following policies:
a. Control which extensions are installed silently: Specify allowed extensions by adding their extension IDs.
b. Configure extension management settings: T o block all extensions, set this policy to "*" (deny all).
c. Configure the list of force-installed extensions: If any extension is necessary for business, add the corresponding extension ID here.
B. Google Chrome
Using Group Policy (Windows)
1. Open the Group Policy Editor.
2. Navigate to: Computer Configuration > Administrative Templates > Google > Google Chrome > Extensions
3. Set the following policies:
a. Block external extensions: Set the policy to block all extensions unless specifically allowed by adding the extension IDs.
b. Configure extension install allow list: If certain extensions are necessary, add their extension IDs here.
c. Configure extension install blocklist: Add a wildcard"*" to block all extensions.
Managing Browser Extensions Using Microsoft Intune
Organizations using Microsoft Intune for endpoint management can apply policies to control browser extension installations across all managed devices. This approach is particularly useful for managing large numbers of endpoints efficiently.
Blocking Extensions in Microsoft Edge Using Intune
1. Sign in to Microsoft Endpoint Manager Admin Center.
2. Navigate to: Devices > Configuration profiles > Create profile
3. Choose:
a. Platform: Windows 10 and later.
b. Profile type: Settings catalog.
4. In the Configuration settings, search for Extensions under Microsoft Edge:
a. Allow specific extensions to be installed (User): Specify allowed extension IDs
b. Control which extensions cannot be installed (User): Add a wildcard"*" to block all extensions.
5. Assign this profile to your target groups (specific users or devices).
Blocking Extensions in Google Chrome Using Intune
1. Sign in to Microsoft Endpoint Manager Admin Center.
2. Navigate to: Devices > Configuration profiles > Create profile
3. Choose:
a. Platform: Windows 10 and later.
b. Profile type: Settings catalog.
4. In the Configuration settings, search for Extensions under Google Chrome\Extensions:
a. Configure extension installation allow list (User): Specify allowed extension IDs
b. Configure extension installation blocklist: Add a wildcard"*" to block all extensions.
5. Assign this profile to your target groups (specific users or devices).
Note: These steps are mentioned for user-based controls. Similar configuration steps can be applied for device-based controls.
Best Practices for Managing Browser Extensions
● Audit Extensions Regularly: Regularly audit the extensions installed on users’ browsers to detect unauthorized or risky extensions.
● User Training: Educate users about the risks associated with browser extensions and how to identify malicious ones.
● Implement a Zero-Trust Model: Always assume that extensions can potentially be compromised. Apply the principle of least privilege when granting extension permissions.
● Use Security Solutions: Consider deploying security solutions that can monitor and block malicious browser activities, including suspicious extension behavior.
Conclusion
Controlling browser extensions in Microsoft Edge and Google Chrome is a critical aspect of securing enterprise endpoints. By implementing the steps outlined above, organizations can significantly reduce the risks associated with browser extensions. Whether you manage your endpoints using Group Policy or Microsoft Intune, these controls can help protect your network from potential extension-related threats. By following this advisory, organizations can take proactive steps to mitigate browser extension risks, enhancing their overall cybersecurity posture.
Reference:
https://www.bleepingcomputer.com/news/security/new-details-reveal-how-hackers-hijacked-35-google-chrome-extensions/
https://learn.microsoft.com/en-us/defender-endpoint/manage-profiles-approve-sys-extensions-intune
https://gbhackers.com/malicious-editthiscookie-extension/#google_vignette
Disclaimer
The information contained in this document is meant to provide general guidance and brief information to the intended recipient pertaining to the incident and recommended action. Therefore, this information is provided "as is" without warranties of any kind, express or implied, including accuracy, timeliness, and completeness. Consequently, under NO condition shall CTM360®, its related partners, directors, principals, agents, or employees be liable for any direct, indirect, accidental, special, exemplary, punitive, consequential, or other damages or claims whatsoever including, but not limited to: loss of data, loss in profits/business, network disruption…etc., arising out of or in connection with this advisory.
For more information:
Email: monitor@ctm360.com Tel: (+973) 77 360 360
Solar Wind Attack Update
SolarWinds - an American software vendor for managing networks and infrastructure has been breached. Orion, a network monitoring product was modified by a state-sponsored threat actor via embedding backdoor code into a legitimate SolarWinds library. This allowed remote access into the victim’s environment and a foothold in their networks; this enabled attacker to obtain privileged credentials.
The SolarWinds Orion products are designed to monitor the networks of systems and report on any security issues. Due to this, there are no comparable limiting boundaries on the scope or potential security impact; this has been made clear by the gradual revelation of more and more high-value targets. Even more worrisome is the fact that the attackers apparently made use of their initial access to targeted organizations, such as FireEye and Microsoft, to compromise tools and code that would then enable them to target other victims. After Microsoft discovered that they were breached via the SolarWinds compromise, they further discovered that their own products were then used “to further the attacks on others.”
The attack was initially disclosed by the cybersecurity firm, FireEye, as early as December 8th but published publicly on 13th. It was revealed that the attack on SolarWinds was conducted by an unknown APT (Advanced Persistent Threat) group. They were able to steal Red Team assessment tools, similarly, used by FireEye to probe its customers’ security. FireEye has made its countermeasures freely available on GitHub.
According to Microsoft, hackers acquired superuser access to SAML token-signing certificates. This SAML certificate was then used to forge new tokens to allow hackers to obtain trusted and highly privileged access to networks.
While analyzing further on this attack, it was discovered that there was another backdoor likely from a second threat actor. This malware was dubbed as SUPERNOVA. This was a web shell planted in the code of the Orion network and applications monitoring platform and enabled attackers to run arbitrary code on machines running the trojanized version of the software.
Hackers inserted malicious code into an updated version of the software, called Orion. Approximately 18,000 SolarWinds customers installed tainted updates, between March and June 2020, onto their systems. The malware was inserted in these Orion app versions:
- Orion Platform 2019.4 HF5, version 2019.4.5200.9083
- Orion Platform 2020.2 RC1, version 2020.2.100.12219
- Orion Platform 2020.2 RC2, version 2020.2.5200.12394
- Orion Platform 2020.2, 2020.2 HF1, version 2020.2.5300.12432
This disclosure was followed by a coordinated report issued by Microsoft, FireEye, SolarWinds, and the U.S. government. The report concluded that SolarWinds had been targeted by threat actors who aimed to gather undisclosed information from major customers of theirs, including FireEye.
Compromise: What is Known so Far
A key indicator of the attack was the conceived backdoor that was able to gain access to and breach the SolarWinds Orion build system. This backdoor was attached to the said system by rescripting the legitimate SolarWinds.Orion.Core.BusinessLayer.dll DLL file. This file was then distributed to SolarWinds’ clients in a supply chain attack. This was achieved due to an automatic update platform used to dispense new software updates; clients were unaware of this taking place.
According to reports, the threat actors may have performed trial runs of the distribution method as early as October 2019. Researchers believe that the attackers had already compromised networks previously; it is suggested that they had harvested information or performed other malicious activities silently for months. Due to this, FireEye eventually detected that they were hacked after the threat actors registered a device to the company’s multi-factor authentication (MFA) system using stolen credentials. The alert from the system, regarding an unknown device, was able to notify FireEye of the compromise.
Recommendations
Urgently update any exploited SolarWinds Orion software to Orion Platform version 2020.2.1 HF 2 and Orion Platform 2019.4 HF 6
Third party vendors who may be susceptible to exposure of this compromise should report as part of responsible disclosure and urgently remediate.
In case of possible exposure devise an incident response plan.
Prioritize the TTPs leveraged by the threat actor mapped to mitre att&ck. This is available in Adversary Intelligence within CTM360’s CyberBlindspot.