By Nermeen Nabil Khear 
Hackers have found a clever new way to abuse Rich Text Format (.RTF) files in phishing attacks, experts have warned.
Cybersecurity researchers Ironscales claim to have observed a “major spike” in these campaigns during 2024, and in the space of just one month (March 2024), the experts say they spotted, and stopped, 6,755 such attacks.
So what makes this attack so unique, and ultimately – successful? Three things, Ironscales says: the use of an outdated file format, attachment personalization, and URL obfuscation.
Attachment personalization
RTF files are quite uncommon these days, the researchers said, which means two things – victims are not that suspicious when they receive them in the email, and security solutions (especially traditional email security filters) don’t flag them as often.
So, when a threat actor sends a phishing email with an .RTF file attached, victims are somewhat more inclined to open it. Which led the researchers to the second point – attachment personalization. They say the criminals found a way to customize the file name in the email, to match the domain of the target recipient. Therefore, the attachment carries the name of the target company, boosting credibility.
Finally, URL obfuscation. In the .RTF file, the crooks would attach a link that “looks innocent enough”, and often appear to lead to a well-known site, such as microsoft.com. However, a clever use of the @ symbol allows them to redirect the victim to a malicious site, instead. The usual link in these files would look something like this: https://www.microsoft.com@malicious-site.com/invoice.pdf.
“In the world of URLs, anything before the @ is treated as a ‘username’ but can be written to look like a trusted domain,” the researchers explained. “The catch? The browser ignores everything before the @ and only cares about what comes after.”
In other words, if the victim is not carefully reading the entire link, they might think they’re visiting microsoft.com, but are instead being redirected elsewhere.
In conclusion, crooks are getting smarter, Ironscales argues, meaning organizations must do the same – or suffer the consequences.
More from TechRadar Pro
New method for phishing discovered for Android and IPhone usersHere’s a list of the best firewalls todayThese are the best endpoint protection tools right now
This articles is written by : Nermeen Nabil Khear Abdelmalak
All rights reserved to : USAGOLDMIES . www.usagoldmines.com
You can Enjoy surfing our website categories and read more content in many fields you may like .
Why USAGoldMines ?
USAGoldMines is a comprehensive website offering the latest in financial, crypto, and technical news. With specialized sections for each category, it provides readers with up-to-date market insights, investment trends, and technological advancements, making it a valuable resource for investors and enthusiasts in the fast-paced financial world.