New Phishing Attack Uses Basic Auth URLs to Trick Users and Steal Login Credentials
In early October 2025, a resurgence of a phishing technique using Basic Authentication URLs was observed. This method exploits legacy URL formats to trick users into revealing sensitive credentials.
In early October 2025, a resurgence of a phishing technique using Basic Authentication URLs was observed. This method exploits legacy URL formats to trick users into revealing sensitive credentials.
Attackers crafted URLs in the format https://username: [email protected] , embedding trusted institution domains within the username field to mimic legitimate services. When clicked, these links lead browsers to authenticate to the malicious domain specified after the @ symbol, allowing attackers to capture the intended credentials.
This approach is especially effective in mobile applications and email clients that truncate URLs, displaying only the deceptive part before the @ symbol.
Netcraft analysts identified the first wave of these attacks targeting GMO Aozora Bank customers in Japan. Attackers registered URLs such as hxxps://gmo-aozora.com% [email protected] /sKgdiq . Victims were directed to a CAPTCHA page designed to simulate a legitimate security check.
In early October 2025, a resurgence of a phishing technique using Basic Authentication URLs was observed.
Despite modern browsers supporting Basic Auth URLs, their use has declined due to security concerns, making them an unexpected vector that evades casual URL scrutiny. More than 200 unique Basic Auth phishing URLs were identified within two weeks, impersonating major brands like Amazon, Google, and Netflix.
Upon clicking a compromised Basic Auth URL, the victim’s browser sends an HTTP GET request with the credentials field set to the trusted domain text. For instance:
GET /sKgdiq HTTP/1.1 Host: coylums.com Authorization: Basic Z21vLWFvem9yYS5jb206
The Base64-encoded string Z21vLWFvem9yYS5jb206 represents gmo-aozora.com: . The server decodes this to verify the embedded "username" before serving a phishing page that mimics the bank’s login interface. Submitted credentials are collected via a POST request to the attacker’s endpoint.
To mitigate these threats, financial institutions and security teams should update URL inspection rules to detect and block Basic Authentication tokens in links. User education on the dangers of embedded credentials is also essential.
Based on reporting by Cyber Security News.