This article explores a malicious campaign utilizing Blogspot links for redirection to various fraudulent sites, including phishing and malware distribution. The campaign targets unsuspecting users who may mistake these links for legitimate content due to their deceptive appearance on social media. It provides detailed insights on how to investigate such redirects and identifies indicators of compromise related to the threat. Affected: Blogspot, Windows, Users, Cyber Security Sector
Keypoints :
- Malicious Blogspot links are being used for redirection to fraudulent sites.
- Victims are often tricked into believing these links are legitimate due to social media previews.
- Types of harmful redirects include ad fraud, pornware, phishing pages, and malware.
- Proton VPN is recommended for safeguarding one’s identity during investigations.
- URL shortening services, including those used by Twitter/X, often obscure original destinations.
- Investigation techniques include using tools like WhereGoes and wget to analyze redirection chains.
- The campaign is linked to a broader operation known as ApateWeb, which employs over 130,000 domains for distributing various scams.
MITRE Techniques :
- Phishing (T1566): By accessing the initially malicious Blogspot link, users are redirected to a phishing page determined by the operating system in use.
- Credential Dumping (T1003): Users may inadvertently disclose credentials to a spoofed support site targeting Windows users.
- Input Data Manipulation (T1601): The embedded JavaScript manipulates query parameters to enhance the deceit.
- Domain Generation Algorithm (DGA) – associated: Attackers utilize dynamic domain strategies to camouflage malicious activities.
Indicator of Compromise :
- [URL] https://bettylinking.blogspot.com/2025/01/tyga.html
- [URL] https://wess1-secondary.z8.web.core.windows.net/werrx01USAHTML/?bcda=1-866-961-8886
- [Domain] altitudehighjackhonorary.com
- [Domain] proftrafficcounter.com
- [Domain] unusuallypilgrim.com
Full Story: https://www.validin.com/blog/malicious_blogspot_apateweb_campaign