Microsoft security researchers discovered an unusual phishing campaign which employs custom 404 error pages to trick potential victims into handing out their Microsoft credentials.
To do this, the attackers register a domain and instead of creating a single phishing landing page to redirect their victims to, they configure a custom 404 page which shows the fake login form.
This allows the phishers to have an infinite amount of phishing landing pages URLs generated with the help of a single registered domain.
“The 404 Not Found page tells you that you’ve hit a broken or dead link – except when it doesn’t,” says Microsoft’s research team.
“Phishers are using malicious custom 404 pages to serve phishing sites. A phishing campaign targeting Microsoft uses such technique, giving phishers virtually unlimited phishing URLs.”
Landing pages disguised as Microsoft sign-ins
The custom 404 error pages these attackers use to harvest their victims’ credentials are perfectly camouflaged as legitimate Microsoft account sign-in pages, down to the smallest details.
All the links on the phishing page, including the ones at the bottom and the ones used to access one’s Microsoft account and to create a new one, are directing straight to official Microsoft login forms in an effort to make targets less suspicious.
The only elements missing from the phishing page are the “Sign-in options” link above the “Next” button and the cookies notification at the top of the page.
“Because the malformed 404 page is served to any non-existent URL in an attacker-controlled domain, the phishers can use random URLs for their campaigns,” adds Microsoft. “We also found that the attackers randomize domains, exponentially increasing the number of phishing URLs.”
The phishing form is designed to collect Microsoft email addresses, phone numbers, or Skype names, that get sent to hotelseacliff[.]com.
The victims are then redirected to a real Microsoft login form masked with a shortened URL after successfully harvesting the credentials.
While Microsoft has already added the URLs used in this campaign to Microsoft Defender SmartScreen’s list of reported phishing, malware, exploit, and scam sites, Google is yet to pick them up and add it to its Safe Browsing blacklist service.
Hosting the custom 404 phishing pages
While custom 404 error pages can be created using several different methods and services, the operators of the phishing campaign spotted by Microsoft’s security research team used the free outlookloffice365user09ngxsmd[.]web[.]app Firebase subdomain.
A support article on the Firebase documentation website shows all the steps one has to go through to customize a 404/Not Found page, making it possible to “serve a custom 404 Not Found error when a user tries to access a page that doesn’t exist.”
Once everything is set up, “Firebase Hosting will display the content of this custom 404.html page if a browser triggers a 404 Not Found error on your domain or subdomain.”
As previously mentioned, attackers could also use other technique of creating phishing landing pages via custom 404 Not Found pages, from self-hosted ones to Amazon CloudFront, Microsoft Azure, Squarespace, Weebly, and a lot more.
This means that each of these services could be abused in similar phishing campaigns, with Microsoft’s own Azure Storage being a prime target, seeing that it can be used for static website hosting and it also provides support for custom 404 pages.
Phishers are already using Microsoft’s Azure Blob Storage object storage solution [1, 2] to host phishing pages, at the same time taking advantage of the fact that they will automatically get signed with an SSL certificate from Microsoft.
This makes Azure Blob Storage-based phishing the ideal method to directly target users of Microsoft services such as Office 365, Azure Active Directory, Outlook and a whole slew of other Microsoft logins.