![\"Warning\"](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/Warning.png\")
<\/p>\nLast week McAfee Labs received a phishing page that efficiently uses the CSS format of the Gmail login page and appears to be a legitimate Gmail page. When we opened the malformed HTML file we sometimes saw this\u00a0warning:<\/p>\n
<\/p>\n
After the warning, the following Gmail login page appeared. Even the\u00a0tech savvy could fall prey to this phishing hook because\u00a0the entire page, except for the \u201cSign In\u201d button, is present on the legitimate Gmail CSS.<\/p>\n
![\"login\"](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/login.png\")
<\/p>\n
The only catch was the URI, which showed \u201cdata:text\/html;base64,DQo8IURPQ1RZUEUgaHRtbD\u2026\u201d instead of gmail.com. The complete HTML page was Base 64 encoded to evade basic antispam gateways. Part of the Base 64\u2013decoded HTML page follows:<\/p>\n
![\"decoded\"](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/decoded-1.png\")
\nOnce a victim enters username and password and signs in, the data in the login form is exfiltrated to an unsecured remote server. We sniffed the packets sent to the remote server and found that the username and password were sent in an unencrypted form over an unsecured HTTP protocol. This makes the theft even worse because credentials could\u00a0easily be snooped through man-in-the-middle or eavesdropping attacks.<\/p>\n
![\"network\"](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/network.png\")
<\/p>\n
Once the credentials are covertly exfiltrated to the remote server, the victim is redirected to the Gmail page. We were surprised to see that these actors have not secured their web servers. We walked through their directory listings and found that they are clearly responsible for stealing user credentials from various portals. Here are a few of their live phishing pages on the unsecured server:<\/p>\n
![\"directory\"](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/directory.png\")
<\/p>\n
<\/p>\n
We went a step further and found that the actors have used virtual web hosting techniques and registered multiple domain names that use the same IP address: 104.193.142.193. Some of the domains serving other phishing campaigns were active during our research.<\/p>\n
![\"dhl\"](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/dhl.png\")
<\/p>\n
![\"yahoo\"](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/yahoo.png\")
<\/p>\n
Some of the domains are mentioned below:<\/p>\n
![\"virustotal1\"](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/virustotal1.png\")
<\/p>\n
While closely looking at some of the preceding\u00a0domains, we found a few that\u00a0were\u00a0registered through the same email address in the past:<\/p>\n
![\"domain_relatedtomercypalace\"](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/domain_relatedtomercypalace.png\")
<\/p>\n
Among these, some live domains, including flayconcepts.com, purtglobal.com, and sparboh.net, contain malicious phishing pages. Email ID mercypalace2000@yahoo.com has registered multiple malicious domains, so the owner of this email ID might be the one of the actors running this malicious activity.<\/p>\n
These actors seem to have used the open-source Gmail hack code available in Github:<\/p>\n
Though the intent of the open-source scripts is to educate enthusiasts and novices in ethical hacking, there are always opportunities for abuse.<\/p>\n
McAfee products offer\u00a0coverage for all of these phishing variants as Phish-SiteFraud.<\/p>\n","protected":false},"excerpt":{"rendered":"
Last week McAfee Labs received a phishing page that efficiently uses the CSS format of the Gmail login page and…<\/p>\n","protected":false},"author":815,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[1814,76,3923,338,142],"coauthors":[4610],"class_list":["post-47531","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-computer-security","tag-cybercrime","tag-email-and-web-security","tag-endpoint-protection","tag-tag-identity-theft"],"acf":[],"yoast_head":"\n