Szabolcs Schmidt
@smica83
Threat Intel Specialist and Incident Responder. Private account. All opinions expressed here are mine only.
bazaar.abuse.ch/user/5160/
ID: 147667505
24-05-2010 18:50:54
15,15K Tweet
2,2K Followers
370 Following
![⚠️ While investigating a new CEO fraud campaign, I discovered that attackers are using a trick to bypass the redirect warning usually shown by Google (google[.]com/url?q=https://www.example[.]com).
This open redirect allows attackers to evade certain detections and stealthily](https://pbs.twimg.com/media/GwP-hcGW8AAiD3V.jpg "Germán Fernández (@1zrr4h) on Twitter photo ⚠️ While investigating a new CEO fraud campaign, I discovered that attackers are using a trick to bypass the redirect warning usually shown by Google (google[.]com/url?q=https://www.example[.]com).
This open redirect allows attackers to evade certain detections and stealthily")
'customer-receipt.pdf.lnk' from Ukraine abuse.ch bazaar.abuse.ch/sample/16b18d7… Original URL(http): /77.110.113(.)73/Documents/customer-receipt.pdf.lnk Coyote(http): /driverupdate.ue3hdn4-cdnsecurefile.com/Chrono24-receipt.pdf Dropped BAT: bazaar.abuse.ch/sample/e2bf4c3… Dropped HTA:
