New Phishing Attack Targeting Major Sectors

A new type of phishing attack is deceiving users into giving up sensitive login credentials without requiring any direct interaction. Researchers from Palo Alto Networks’ Unit 42 have identified phishing campaigns that use refresh entries in HTTP response headers to automatically redirect users to attacker-controlled pages, bypassing traditional security measures. This technique has targeted employees in sectors such as finance, government, and education throughout 2024.

How the HTTP Refresh Header Technique Works

Phishing attacks have changed in recent years, with attackers now exploiting creative methods to strike on traditional security mechanisms. The HTTP refresh header method involves injecting an automatic redirection into the HTTP response before the webpage content is even processed. This type of phishing attack takes place even before the HTML content of a webpage is processed. When a user clicks on a link, the browser loads the webpage and processes the HTML content.

With this header refresh technique, the browser is instructed by the server to automatically refresh or reload a webpage via the refresh entry in the HTTP response header, sending the victim to a malicious site without their knowledge. The process happens so quickly that users may not realize they’ve been redirected to an illegitimate page. The URLs involved in these attacks are embedded within phishing emails, where the original and landing URLs look legitimate or belong to compromised domains, making it difficult for users to identify potential threats. Attackers may also use legitimate services that offer URL shortening or tracking to disguise the malicious intent further.

Unlike conventional phishing tactics that rely on malicious links leading directly to fraudulent sites, this technique ensures that redirection occurs seamlessly, making it harder to detect. Since the initial request appears legitimate, security tools such as email scanners and web filters may not flag the link as suspicious.

How Phishing Attacks Exploit HTTP Response Headers

HTTP response headers contain metadata that instructs a browser on how to process a webpage. The [Refresh] directive can be used for legitimate purposes, such as reloading a page after a certain interval. Attackers manipulate this feature by injecting an immediate redirection to a phishing page.

This method works by:

Embedding the phishing URL in the [Refresh] header before the HTML content is loaded.
Redirecting the victim to a fraudulent login page that mimics a trusted service.
Collecting user credentials, which are then transmitted to the attacker’s server.

By executing the redirect before the webpage is rendered, security defenses relying on page content analysis are bypassed, making detection more challenging.

Evasion Techniques Used by Attackers

Cybercriminals employ several tactics to avoid detection and maximize success rates:

SSL/TLS Certificates for Legitimacy: Many phishing sites now use HTTPS with valid SSL certificates, preventing users from receiving browser security warnings.
Compromised Legitimate Websites: Instead of creating new domains, attackers inject phishing content into trusted websites, reducing suspicion.
User-Agent and IP Filtering: Some campaigns ensure that phishing pages only load for specific users, while security researchers or automated scanners see harmless content.
Redirection via Trusted Services: Attackers exploit services such as Google Ads, Microsoft 365 links, or cloud storage URLs to mask phishing links within trusted domains.

These evasion tactics make it increasingly difficult for traditional security tools to identify phishing attempts before user credentials are stolen.

Personalization of Phishing Attacks

What makes these phishing attacks more dangerous than others, is the level of personalization they involve. Attackers use URL parameters to pre-fill login forms with the victim’s email address or other personal information. This customization increases the credibility of the phishing page, making it more likely that victims will fall for the scam. When a targeted user clicks on a phishing link, they may see a webmail login page resembling a legitimate service such as Microsoft Outlook or Gmail, already pre-filled with their own email address.

The personalization of phishing attacks brings a false sense of legitimacy, leading victims to enter their password or other sensitive credentials. This can be achieved through:

URL Parameters: Attackers embed email addresses and organization details in phishing links to make login prompts appear more legitimate.
Dynamic Content Injection: Phishing pages generate personalized elements on-the-fly, based on information extracted from the phishing link.
Deep Linking Strategies: Some campaigns ensure that users land on a tailored phishing page that mirrors the actual login experience of their company’s authentication portal.

By increasing familiarity and trust, these tactics lead to a higher success rate in credential theft.

Targeted Industries and Global Scale

Unit 42’s research highlights the broad impact of these phishing campaigns. Between May and July 2024, over 2,000 malicious URLs were detected daily, with financial services, government agencies, and educational institutions among the most targeted sectors.

Financial Services (36% of detected attacks): Cybercriminals target online banking portals, investment accounts, and internal financial tools.
Government Agencies: Espionage-motivated attacks seek access to classified data and critical infrastructure.
Educational Institutions: Universities face credential theft aimed at accessing research data and student records.

Phishing emails in these campaigns frequently originate from spoofed sender addresses. Attackers use domain spoofing and email content that appears legitimate, making it difficult for recipients to identify fraudulent communications.

Examples of HTTP refresh header-based Phishing Campaigns

An example of a phishing attack using the HTTP refresh header method was observed in July 2024. A phishing email sent to employees of a large financial institution contained a link to what appeared to be a legitimate webmail login page. Once the link was clicked, the victim was automatically redirected to a phishing page that closely mimicked the official login portal, with their email address already pre-filled in the login field.

These attacks are widespread, and Unit 42 researchers observed large-scale phishing campaigns affecting corporations and government agencies across multiple countries. One campaign which targeted users in Korea and the U.S., used emails with the subject line “Complete with DocuSign: ACH/EFT FORM.” The emails were designed to trick users into clicking links that redirected them to phishing pages, where their login credentials could be harvested.

Mitigation Strategies and Security Measures to be implemented

Organizations can take several steps to protect against HTTP refresh header-based phishing attacks:

Behavior-Based Threat Detection: Implementing machine-learning-driven security tools can identify suspicious redirections and phishing tactics in real time.
Zero-Trust Authentication: Requiring multi-factor authentication (MFA), particularly phishing-resistant methods such as hardware security keys, reduces the risk of credential misuse.
DNS and Web Filtering: Deploying secure DNS solutions and web gateways can block malicious redirects before they reach users.
Advanced Email Security Measures: Secure email gateways should inspect email links for redirection behavior and flag suspicious domains.
Security Awareness Training: Employees should be trained to recognize unexpected login requests and to manually enter URLs instead of clicking links in emails.
Incident Response Readiness: Organizations should establish response protocols for suspected phishing incidents, including account lockouts, credential resets, and forensic analysis.

Phishing attacks that use HTTP response headers are a modern representation of how attackers can manipulate web traffic to steal information. By using these tactics with legitimate domains to hide their malicious intent, these campaigns can deceive unsuspecting victims. Organizations in finance, government, and education, should implement strong cybersecurity measures such as URL filtering to detect and block these malicious redirects. Advanced URL Filtering measures, such as those provided by Palo Alto Networks, can help detect suspicious URLs and prevent unauthorized access to information. If you believe your organization has been compromised by one of these phishing attacks, contacting an incident response team is important, to lessen potential damage and prevent incidents.

Photo credits: janews094, AdobeStock