Security News > 2022 > August > Phishing attack abuses Microsoft Azure, Google Sites to steal crypto
A new large-scale phishing campaign targeting Coinbase, MetaMask, Kraken, and Gemini users is abusing Google Sites and Microsoft Azure Web App to create fraudulent sites.
Posting links to phishing pages on various legitimate sites aims to increase traffic and boost the malicious site's search engine rankings.
Because the phishing sites are hosted in Microsoft and Google services, they aren't flagged by automated moderator systems, allowing promotional messages to stay in the comment section for longer.
Google Sites is a free web page creation tool, part of Google's online service suite, allowing users to create websites and host them on Google Cloud or other providers.
The sites are just landing pages, and their visitors are redirected to the actual phishing sites when they click on the "Login" buttons.
For the crypto exchange phishing pages, the threat actors attempt to steal their login credentials.
News URL
Related news
- Ransomware gangs pose as IT support in Microsoft Teams phishing attacks (source)
- Microsoft Teams phishing attack alerts coming to everyone next month (source)
- Microsoft: Hackers steal emails in device code phishing attacks (source)
- Microsoft Bing shows misleading Google-like page for 'Google' searches (source)
- Criminal IP: Bringing Real-Time Phishing Detection to Microsoft Outlook (source)
- New Web3 attack exploits transaction simulations to steal crypto (source)
- Microsoft Sues Hacking Group Exploiting Azure AI for Harmful Content Creation (source)
- Azure, Microsoft 365 MFA outage locks out users across regions (source)
- Hackers use FastHTTP in new high-speed Microsoft 365 password attacks (source)
- Microsoft fixes under-attack privilege-escalation holes in Hyper-V (source)