Gone Phishing
This is a blog on some of the latest phishing threats that are out there and ones I have recently, personally experienced and reverse engineered. On 1 May I received this SMS text: Just received this: (1 May) http://security[.]hsbcuk[.]confirm-securekey[.]com @HSBC_UK #phishing #smishing (I’m not with HSBC) pic.twitter.com/HU3sqBlPhz — Will | BushidoToken 👁🗨 (@BushidoToken) May 1, 2020 To me, it was quite clearly a phish, as I'm not with HSBC, however, someone who is may have been easily fooled. The trick the phishermen used here is via a subdomain. Average users may be able to recognise their usual bank domain and feel safe. However, the threat actors who sent this to me could use a domain like 'digitalbanking.com' (which is for sale ) and simply insert my bank's full URL as a subdomain - making it quite convincing. Plus, they can add a free digital certificate from Let's Encrypt CA to give it HTTPS and now we have a pretty convincing phish. ...