The Rise of Precision-Validated Credential Theft: A New Challenge for Defenders

A new evolution in the realm of phishing is taking the precision tactics of spear-phishing to new heights. Email-based phishing attacks generally have two major stumbling blocks that can reduce their effectiveness: the data they collect may not be very useful, and the email addresses they use can be traced by cybersecurity defenders, revealing the attacker’s infrastructure. This new technique, known as precision-validated phishing, mitigates both of these problems.

Precision-validated phishing is used when a threat actor wants a specific set of targets, and only those targets, to be able to engage with their phishing pages. The technique abuses legitimate email verification APIs, creating validation scripts that check the email accessing a phishing page against a predetermined set of targets. If the email does not match any entry on that list, the accessor is either blocked with a manufactured error or redirected to a legitimate, benign webpage. Only if the email matches an entry on the target list does the attacker display the actual phishing form used to harvest data.

There are several benefits for attackers, and several challenges presented to cybersecurity defenders. Normal analysis of phishing attacks involves submitting fake credentials in order to gain access to the phishing forms, but precision-validated phishing makes this impossible. Analysis requires an actual vulnerable email to be put at risk, a thing which enterprises naturally do not want to do. The technique also undermines signature-based detection, since URL scanning tools will only see the benign content served to a target not on the list, rather than the malicious content intended for the specific targets. New techniques will be required to fight back against this new method, including a shift towards behavior-based analysis rather than signature-based, along with real time anomaly detection.

‍