Phishing Scammers Push for Callbacks in Latest Innovation

The phishing industry is a never ending font of novelty and innovation. Cyber fraudsters are determined to worm their way into your inbox.

See Also: Why Cyberattackers Love ‘Living Off the Land’

Recent attacks involve callback phishing, a social engineering tactic designed to break down victims’ defenses by spurring them into calling the scammers themselves, after which attackers can pry into wallets by playing on emotions.

That real-time interaction is key, threat intel firm Cisco Talos said in a Wednesday report. “The live interaction during a phone call enables attackers to manipulate the victim’s emotions and responses by employing social engineering tactics,” said Omid Mirzaei, security research lead in the email threat research team at Cisco Talos.

The bait in such cases often is a PDF document tweaked to make it past email filters, often sporting well-known logos to appear legitimate.

“Victims are instructed to call a specific number in the PDF to resolve an issue or confirm a transaction,” Mirzaei wrote. Once the victim calls, attackers pose as a legitimate representative and attempt to manipulate callers “into disclosing confidential information or installing malicious software on their computer.”

Microsoft, NortonLifeLock, PayPal, DocuSign and Geek Squad rank among brands most impersonated by attackers in so-called callback phishing emails. Many of these emails originate from IP addresses in the United States and Western Europe.

The VoIP telephone numbers used by phishers often persist for days, thanks to many organizations not sharing such information. The longer an attacker can maintain a number, the greater the chance that a phishing email recipient might phone.

One challenge is that hackers have techniques for smuggling the PDF past defenses. “For example, a phishing URL might be embedded in a text annotation, sticky note comment or form field within a PDF attachment,” Mirzaei said. “Alternatively, attackers may add irrelevant text – or ‘noise’ – to bypass detection systems.”

To add the appearance of further authenticity, if an individual clicks an attacker-provided URL, the site they visit might show a CAPTCHA challenge before resolving to a branded landing page. In some cases, phishing attacks resolve to a fake Dropbox site.

Scammers learn from each other, of course. The Ryuk ransomware group in 2021 pioneered a type of callback phishing known as BazarCall or BazaCall. This typically involves an attacker telephoning a company and pretending to be a customer support specialist. The goal was to trick the individual into installing remote-control software. The Conti ransomware group also experimented with this tactic.

Phishing-focused attackers have joined the fray. This reflects that for most criminals, time is money and they’ll freely adopt and adapt any tactic that promises to deliver illicit profits more easily and quickly.

Abusing Microsoft 365

Another emerging phishing tactic is to use a feature built into the Microsoft 365 subscription service that provides access to multiple productivity applications and cloud services, called Direct Send.

The feature is designed to enable devices and services, such as printers or appointment apps, to easily send emails internally.

Varonis Threat Labs in May observed attackers abusing the feature after breaching dozens of corporate networks predominantly in the U.S., to distribute phishing messages internally. Such messages typically come from smart hosts that use an address in a format such as: tenantname.mail.protection.outlook.com. Such messages can be sent within a Microsoft 365 tenant, with no authentication required.

“Once a threat actor has the domain and a valid recipient, they can send spoofed emails that appear to originate from inside the organization, without ever logging in or touching the tenant,” said Tom Barnea, a forensics specialist at Varonis. “This simplicity makes Direct Send an attractive and low-effort vector for phishing campaigns.”

Weaponizing ASCII Art

Whenever defenders can block commonly used phishing tactics, criminals seek workarounds. Take QR codes designed to direct victims to malicious websites. Anti-phishing toolmakers added OCR scanning of incoming emails, including the ability to interpret QR codes and identify the URL to which they redirected, at which point tools could assess if the destination site was malicious and if so block it.

In response, attackers last year began using ASCII or Unicode “full block” characters together with cascading style sheets to cobble together a working QR code, mapped onto the typical 49-by-49 pixel matrix (see: Malicious Pixels: Criminals Revamp QR Code Phishing Attacks).

One day, hopefully soon, defenders will block that technique. The phishing industry will move on to the next iteration.