URL rewriting is a security measure that replaces original email links with modified ones to route traffic through a security vendor’s server for real-time threat analysis, which is effective against known threats but susceptible to evasion by attackers.
Legacy systems rely on static threat intelligence, while newer approaches leverage machine learning for proactive detection, but attackers increasingly exploit URL rewriting mechanisms, rendering them less effective as a standalone defense strategy.
Threat actors are exploiting URL rewriting, a security feature designed to protect users, by manipulating rewritten links to mask malicious phishing URLs behind trusted security vendor domains.
This evasion tactic, bypassing traditional and AI-based email security solutions, has significantly increased the prevalence of advanced phishing attacks, turning a defensive tool into an offensive weapon for attackers.
Cybercriminals are leveraging email security vendors’ URL rewriting services for phishing attacks by compromising legitimate email accounts protected by URL rewriting, self-sending emails containing malicious links, and exploiting the service to replace these links with seemingly legitimate ones.
The “branded” URL bypasses further security checks, allowing attackers to redirect victims to phishing sites, which exploits user trust in security vendors and the time gap between URL rewriting and weaponization, evading traditional security measures.
Perception Point’s Advanced Email Security intercepted a phishing attack that exploited a “double rewrite” vulnerability in Proofpoint and INKY security systems.
The email contained a URL disguised as a SharePoint notification, rewritten first by Proofpoint (urldefense.proofpoint.com) and then by INKY (shared.outlook.inky.com).
Clicking the link led to a CAPTCHA page designed to bypass automated threat detection and ultimately redirect users to a fake Microsoft 365 login page for credential theft, which highlights the importance of in-line dynamic URL analysis for effective phishing defense.
Attackers leveraged a compromised account to generate a rewritten URL via Proofpoint and INKY, which was initially used within the compromised organization but was subsequently repurposed for phishing attacks against multiple other organizations.
By exploiting the trust associated with these security services, the attackers transformed a single compromised account into a platform for a widespread phishing campaign, demonstrating the potential for attackers to manipulate security measures for a broader impact.
Attackers are exploiting email security features like URL rewriting by Mimecast and Sophos to bypass detection, which rewrites email links to scan them for threats, but attackers are using the rewritten, seemingly safe URLs to mask malicious destinations (e.g., ycnrw8.com, strategiclandlording.com) designed to steal credentials or personal information.
