In a statement, Check Point said this phishing page would request Office365 credentials and lead to a genuine PDF report published by a well-known global consulting firm.
While the page was hosted on Google Cloud Storage, the malicious source code had been traced to an IP address belonging to Ukraine, the researchers added.
Check Point said this appeared to a be a growing trend because the attackers could disguise their malicious intentions and avoid being spotted due to more traditional flags such as suspicious domains or websites without an encryption certificate.
|
|
When an option was chosen, a pop-up window appeared with the Outlook login page. Once credentials were entered, the user was directed to a genuine PDF report published by a well-known global consulting firm.
It was unlikely that the user;s suspicions would be aroused because the phishing page is hosted on Google Cloud Storage, Check Point said.
But looking at source code for the phishing page showed that most of the resources were loaded from a website that belongs to the attackers, prvtsmtp[.]com.
The attackers were using Google Cloud Functions, a service that allows the running of code in the cloud. The phishing page resources were loaded from a Google Cloud Functions instance without exposing the attackers’ own malicious domains.
Check Point said investigating prvtsmtp[.]com showed that it resolved to a Ukrainian IP address (31.28.168[.]4). Many other domains related to this phishing attack resolved to the same IP address, or to different ones within the same netblock.
