Security firm Lookout uncovered an ongoing spear-phishing campaign aimed at NGOs, including human rights organizations such as the Red Cross, UNICEF, the UN World Food and the UN Development programs.
The analysis of the server infrastructure behind the campaign shows that the attackers have to be active at least since March 2019. The company immediately reported his findings to targeted organizations and law enforcement agencies.
“Lookout Phishing AI has detected a mobile-aware phishing campaign targeting non-governmental organizations around the world, including a variety of United Nations humanitarian organizations, such as UNICEF.” reads the analysis published by the company. “The infrastructure connected to this attack has been live since March 2019. Two domains have been hosting phishing content, session-services[.]com and service-ssl-check[.]com, which resolved to two IPs over the course of this campaign: 111.90.142.105 and 111.90.142.91.”
The domains used in the campaign were not labeled as malicious by services like Google Safe Browsing.
Experts noticed that the threat actors employed several noteworthy techniques in this campaign, such as the ability to detect mobile devices and to log keystrokes.
Attackers deployed a Javascript code on the phishing pages that is able to determine if the user is accessing the page with a mobile device and delivers mobile specially-crafted content.
The experts also collected evidence of keylogging functionality embedded in the password field of the phishing login pages. After the victims provided their credentials to bogus Office 365 login forms, the sites display customized pages to show that the users successfully’ log into their accounts.
The sites used in the campaign use SSL certificates to appear as legitimate Microsoft Office 365 login pages.
“SSL certificates used by the phishing infrastructure had two main ranges of validity: May 5, 2019 to August 3, 2019, and June 5, 2019 to September 3, 2019. Currently six certificates are still valid, and Lookout suspects that these attacks may still be ongoing.” continues the analysis.
Experts pointed out that major browsers will alert users about the use of expired SSL certificates, this means that expired SSL certificates observed on some of the phishing sites can precious information on the campaign.
Below the list of certificates used in the spear-phishing attacks as part of this campaign:
| Target Organization | URL | Live SSL Certificate |
| UN World Food Programme | fs.auth.wfp.org.adfs.ls.client-request-id.session-services.com | Valid until November 23 |
| United Nations Development Programme | logon.undp.org.adfs.ls.client-request-id.session-services.com | Valid until November 18 |
| United Nations | sso.united.un.org.adfs.ls.clinet-request-id.session-services.com | Valid until November 15 |
| UNICEF | login.unicef.org.adfs.ls.client-request-id.session-services.com | Valid until November 16 |
| Heritage Foundation | heritage.onelogin.com.login.service-ssl-check.com | Valid until November 18 |
| International Federation of the Red Cross and Red Crescent Societies | sts.ifrc.org.adfs.ls.client-request-id.session-services.com | Valid until November 16 |
| United States Institute of Peace | login.microsoftonline.com.common.oauth2.ip.session-services.com | Expired August 3 |
| Concern Worldwide | login.microsoftonline.com.common.oauth2.co.session-services.com | Expired September 8 |
| Humanity and Inclusion (French) | login.microsoftonline.com.common.oauth2.hi.session-services.com | Expired September 7 |
| Social Science Research Council Sign-On Portal | sso.ssrc.org.adfs.ls.client-request-id.63f91e15.service-ssl-check.com | Expired September 3 |
| UC San Diego | login.microsoftonline.com.common.oauth2.uc.session-services.com | Expired August 3 |
| East-West Center | eastwestcenter.org.owa.auth.logon.aspx.replacecurrent.service-ssl-check.com | Expired September 3 |
| Unknown/ Inaccessible | login.microsoftonline.com.common.oauth2.br.session-services.com | Expired August 3 |
| Unknown/ Inaccessible | login.microsoftonline.com.common.oauth2.client.us.service-ssl-check.com | Expired September 3 |
| Unknown/ Inaccessible | login.microsoftonline.com.common.oauth2.client.al.service-ssl-check.com | Expired September 3 |
| Unknown/ Inaccessible | login.microsoftonline.com.common.oauth2.client.hi.service-ssl-check.com | Expired September 3 |
| Yahoo (German) | login.yahoo.com.manage-account.src-ym.lang-en-us.session-services.com | Expired August 3 |
| AOL (German) | login.aol.com.account.challenge.oauth.session-services.com | Expired August 3 |
At the time, it is not clear the motivation behind the spear-phishing campaign, both nation-state hackers and cybercriminals have targeted NGOs in the past for intelligence gathering or to conduct scams.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – iCloud, zero-day)
[adrotate banner=”5″]
[adrotate banner=”13″]
A critical vulnerability in the WordPress Automatic plugin is being exploited to inject backdoors and…
As cryptocurrencies have grown in popularity, there has also been growing concern about cybercrime involvement…
Healthcare service provider Kaiser Permanente disclosed a security breach that may impact 13.4 million individuals…
Over 1,400 CrushFTP internet-facing servers are vulnerable to attacks exploiting recently disclosed CVE-2024-4040 vulnerability. Over…
A ransomware attack on a Swedish logistics company Skanlog severely impacted the country's liquor supply. …
CISA adds Cisco ASA and FTD and CrushFTP VFS vulnerabilities to its Known Exploited Vulnerabilities…
This website uses cookies.