A newly observed phishing campaign is targeting customers of Japan’s GMO Aozora Bank by exploiting a legacy web structure known as Basic Authentication to disguise malicious URLs.
Researchers at Netcraft discovered several phishing URLs crafted to impersonate legitimate banking sites while redirecting users to malicious domains that harvest login credentials.
Legacy Technique Used for Modern Deception
Basic Authentication is an old web protocol designed initially to pass login credentials directly in the URL using the format. https://username:password@domain.com.
While the method is now deprecated mainly due to inherent risks, most modern browsers still support it, offering attackers an opportunity for deception.
In phishing attacks, threat actors exploit the structure by inserting a trusted brand’s domain name (such as gmo-aozora.com) in the username section before the @ symbol. Everything before that symbol is treated as authentication data, not the actual destination.
The real domain, the one hosting the phishing page, appears after the @. This trick misleads users into believing they are accessing a legitimate site, particularly in mobile environments where URLs are truncated or only partially visible.
Netcraft’s investigation identified multiple deceptive URLs targeting GMO Aozora’s customers, such as:hxxps://gmo-aozora[.]com%25Z9IQ7POD%25...@coylums[.]com/sKgdiq
and other variations hosted on domains like blitzfest[.]com and pavelrehurek[.]com.
Each used obfuscated strings within the username field, mimicking secure session tokens. The phishing pages shared the same path /sKgdiq/ and featured a fake CAPTCHA security verification screen written in Japanese to bolster credibility.
Phishing Trend Targets Japan
Further analysis revealed that this Basic Auth technique is being reused across multiple brand impersonations. Over a two-week period, at least 214 unique phishing URLs were recorded, targeting high-profile names including Amazon, Google, Facebook, Yahoo, Netflix, and Bank of America.
Roughly 71.5% of all samples (153 URLs) targeted Japanese users or companies, identified by .jp domains and localized text.
In one case, the attackers crafted a fake Netflix domain embedded within a Basic Auth URL to lure recipients via urgent email alerts. The malicious destination, hidden behind perceived legitimacy, resolved to themiran[.]net.
Researchers speculate that the campaign’s focus on Japan could be linked to how specific email clients or mobile browsers display truncated URLs, making the deceptive format more visually convincing.
This campaign underscores how enduring compatibility with outdated web features can be weaponized by modern phishing groups.
Netcraft urges organizations to educate users about the risks of URLs containing embedded credentials and to implement URL inspection policies that flag the presence of @ symbols in links. Browser-level mitigations can further help by warning or blocking access to such legacy-formatted URLs.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
