Hackers Exploits Glitch Platform to Launch Phishing URLs

Share post:

The DomainTools research team has uncovered a phishing campaign that actively exploits the Glitch platform to display short-lived phishing site URLs.

To bypass antivirus security, actors send emails with attachments to PDF documents that do not contain malicious code, but the PDFs contain a link that directs the user to a site hosted by Glitch.

A careful examination of these PDF links shows that they contain JavaScript, which is used to steal credentials to an email address after being forwarded via compromised WordPress pages. Further revelations show that Glitch is just one of several channels that the threat actors use to bypass detection and steal credentials.

Other sites where the hackers host similar documents include Heroku, SelCDN.

Glitch is a cloud hosting service that allows people to deploy apps and websites using Node.js, React and other development platforms. However, factors such as the favourable view Glitch enjoys from security platforms, short-lived URLs and the fact that threat actors could host them for free make Glitch an excellent target for abuse.

For more information, read the original story in Bleeping Computer.

SUBSCRIBE NOW

Related articles

Cyber Security Today, May 24, 2024 – A threat actor leverages Windows BitLocker in ransomware attacks, beware of ORB networks, and more

A threat actor leverages Windows BitLocker in ransomware attacks, beware of ORB networks, and more. Welcome to Cyber Security...

Canada centralizing cybersecurity efforts of federal IT departments

Federal departments and agencies are making only marginal progress in improving their cyber maturity, Ottawa said Wednesday as...

Cyber Security Today, May 22, 2024 – LockBit ransomware gang hits more victims, Fluent Bit servers need to be updated, and more

LockBit ransomware gang hits more victims, Fluent Bit servers need to be updated, and more. Welcome to Cyber Security...

Google criticizes Microsoft’s security practices in new report

Google has publicly criticized Microsoft for a series of security missteps, suggesting that organizations might consider more secure...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways