⚠️ OneDrive abused by phishers in a new HTML Blob Smuggling Campaign
🎯 Attackers create an illusion, leading victims to believe they are logging into a legitimate platform. The website’s design, background, and icons are stored on IPFS, while lure images, mimicking real services, are hosted on imgur .com

📡 Stolen credentials are sent via an HTTP POST request to the C2 server to /cgi/reform/def.php. Inside the .php file, parameters ‘ai’ and ‘pr’ correspond to the login and password, respectively

Using ANYRUN’s MITM feature, we extracted base.js from the traffic and decoded it. The code is well-written and annotated with comments

📌 The attack begins with a bait placed on OneDrive. After clicking the link, the user is redirected to the main page containing the HTML Blob Smuggling code. After the victim enters their credentials, they are redirected to a legitimate website

Take a look at the sandbox sessions:
app.any.run/tasks/72d89e45-ae4…
app.any.run/tasks/a47ee9d9-d4a…
app.any.run/tasks/ad0a4b1a-a10…

Phish URL:
hxxps:// naumnaumovskiborce[.]edu[.] mk/bin/4qan55wfjn6osjafzo63[.]html

Analyze and investigate the latest #malware and #phishing threats with ANYRUN 🛡️

#infosec #cybersecurity #threatintel