New Phishing Technique Targets Users via Basic Auth URLs
Netcraft has identified a suspicious URL targeting GMO Aozora Bank, a financial institution in Japan. The URL employs Basic Authentication URL formatting, an outdated web technique, to mimic the bank's appearance and deceive customers.
Netcraft has identified a suspicious URL targeting GMO Aozora Bank, a financial institution in Japan. The URL employs Basic Authentication URL formatting, an outdated web technique, to mimic the bank's appearance and deceive customers.
Basic Authentication is an older method for passing credentials via a URL, using the format hxxps://username:password@domain.com . Although it was initially designed for simple access control on early web servers, it is rarely used today due to security concerns. Despite this, modern browsers still support the syntax, allowing its use for visual deception in phishing attacks.
In these phishing attacks, attackers place a trusted domain in the “username” section of the URL, followed by an @ symbol and the actual malicious domain. Users who only skim or view truncated links may see the trusted domain first and click without noticing the real destination.
Researchers have uncovered a campaign involving URLs structured similarly to the initial one targeting GMO Aozora Bank. Each URL embedded gmo-aozora.com (or a variant) before the @ and directed to unrelated domains hosting identical phishing pages. An example of such a URL is:
hxxps://gmo-aozora.com%25Z9IQ7POD%25b5r14s6j%257DdIL@coylums.com/sKgdiq
The domains coylums.com , blitzfest.com , and pavelrehurek.com served the same phishing content under the path /sKgdiq .
Netcraft has identified a suspicious URL targeting GMO Aozora Bank, a financial institution in Japan.
Historical DNS and hosting records show these domains previously displayed a Japanese-language CAPTCHA page labeled “Security Check.” This page falsely assured users of legitimacy before presenting a fake login form.
To assess the prevalence of Basic Auth phishing, researchers analyzed URLs over a 14-day period, identifying at least 214 unique examples. These phishing attempts targeted major global brands such as:
Amazon: hxxps://amazon.jp-bghqtjbe%2Fufeuxoj…@lyfak.com/xekqxdyfj/rovglb… Google: hxxps://accounts.google.com+signin=secure…@lzx.enj.mybluehost.me/wp-admin… Facebook: hxxps://facebook.com@links.truthsocial.com/link/114903467869602196
Approximately 71.5% of the 214 URLs specifically targeted Japanese users and organizations by incorporating the .jp top-level domain or Japan-specific domains like docomo.co.jp and ocn.ne.jp .
Phishing emails typically posed as urgent notifications, such as account closures or security alerts, urging users to click deceptive links and complete fake login or verification processes.
This investigation highlights how legacy web features like Basic Authentication URL formatting remain effective tools for threat actors. Despite being deprecated, the compatibility with modern browsers and its ability to visually mislead users maintain its effectiveness.
While this campaign against Japanese financial and consumer brands demonstrates the potential of combining archaic functionalities with targeted social engineering, vigilance in link inspection and improved browser UI cues are essential to mitigate these attacks.
Based on reporting by GBHackers.