LinkedIn Redirect Abuse

Jun. 10, 2024

Key Points

Approximately 117,000 messages were observed abusing LinkedIn generated redirect across two major campaigns between March and April 2024
This redirect technique helps threat actors evade traditional security measures by hiding a malicious link in the URL for a trusted domain.
The primary intent was to steal credentials of recipients most likely to sell for profit.

Introduction

Threat actors are continuing to abuse a redirect that can be generated through LinkedIn, encouraging potential victims to click through to a malicious webpage designed to steal credentials.

The redirects are generated from public facing pages on LinkedIn for personal or company profiles. These profiles will include a section with a link to an external site which can be retrieved as a redirect URL generated by LinkedIn. This technique can help threat actors bypass security measures designed to protect against malicious URLs and land an email into the inbox of unsuspecting victims.

Campaigns

There have been 2 major campaigns observed across two days in March and April 2024, using a similar theme of notifying the recipient they have received a new audio message review, with a link to click through to listen.

Subject:1Message Received From Caller

Threat-Notification-LinkedIn Redirect-Abuse-1.png

Subject:INTEL NEW

Threat-Notification-LinkedIn Redirect-Abuse-2.png

By analyzing the headers for the email, we can see that it was sent from an Amazon SES account likely compromised by the threat actor. The benefit to the threat actor of compromising an SES account is they can then send malicious emails from a trusted source where the regular security including SPF, DKIM and DMARC will most likely pass.

Redirect

Below is a LinkedIn URL redirect example taken from the second campaign.

hxxps://www.linkedin[.]com/redir/redirect?url=https%3A%2F%2Flookerstudio%2Egoogle%2Ecom%2Fs%2FscrHqwjeA3k&urlhash=dcQj&trk=public_profile-settings_topcard-website

This LinkedIn redirect is not an open redirect, meaning it cannot be abused simply by replacing the section of the URL query containing the redirect destination. This implies the threat actor had to generate the URL from LinkedIn. The threat actor likely generated this redirect by creating a public profile through LinkedIn then adding sections to it which contain a link to an external resource. A threat actor can then copy the redirect generated by LinkedIn and paste it into an email campaign.

Redirect Chain
Looking at one of the LinkedIn redirect links from one of the above campaigns…

URL format:
hxxps://www.linkedin[.]com/redir/redirect?url=https%3A%2F%2Flookerstudio%2Egoogle%2Ecom%2Fs%2FscrHqwjeA3k&urlhash=dcQj&trk=public_profile-settings_topcard-website

Landing page
hxxps://lookerstudio.google[.]com/reporting/ce8908e1-d4e1-46d1-9087-7b8dc3e8dd6f/page/67CrD?s=scrHqwjeA3k

Threat-Notification-LinkedIn Redirect-Abuse-3.png

Captcha

The threat actor has included a Cloudflare captcha through one of the redirect URLs to make it difficult for security tools to scan the link and determine if the final URL resolved to is malicious.

hxxps://okc.palledon[.]com/?unkbjkwn=0aae36c6e061aa3f26cbcc34c062b75b18a753529a21b5df81391f2085dc3140ab0c7064a0c6b7ff5bf35f00be826d862bbb107de90164655f78f7ddf91fc468

Threat-Notification-LinkedIn Redirect-Abuse-4.png

Credential capture page

Final phishing page impersonating Microsoft online to capture and steal user credentials.

hxxps://index.keltinag[.]com/?ay14c1s87=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9YzFjZTlkYTEtNmM1OS1kNDhmLWI0Y2YtZjZiZjM2ZDgxYWU2JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUxOTAwNDY4MDYwMTAxMS41ZjcwYmQxZi05YWQ5LTQ3OTMtYmZiZS05MWI3NTBjYWUyZDYmc3RhdGU9RGN0QkZvQWdDQUJSck5keFNNZ0VPWTZrYmx0Ml9WajgyVTBDZ0Qxc0lWRUVWRXFyYkVTM05CSmlZajdyVXZMQkM2MFB3MXV0b0MtZmFPeGE2ZW56R3BMaVBmTDc5ZndE

Threat-Notification-LinkedIn Redirect-Abuse-5.png

Decoding the base64 query string on the end of the credential capture page URL decodes to:
hxxps://login.microsoftonline[.]com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=hxxps://outlook.office[.]com/owa/&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code id_token&scope=openid&msafed=1&msaredir=1&client-request-id=c1ce9da1-6c59-d48f-b4cf-f6bf36d81ae6&protectedtoken=true&claims={"id_token":{"xms_cc":{"values":["CP1"]}}}&nonce=638519004680601011.5f70bd1f-9ad9-4793-bfbe-91b750cae2d6&state=DctBFoAgCABRrNdxSMgEOY6kblt2_Vj82U0CgD1sIVEEVEqrbES3NBJiYj7rUvLBC60Pw1utoC-faOxa6enzGpLiPfL79fwD

This is a common technique used by threat actors for credential phishing pages. The victim will enter their credentials then be displayed with a fake login failure message. They will then be redirected to the legitimate login page. The victim will think they just entered their credentials incorrectly the first time and try again on the legitimate login page.

Attack Pattern

Given the complexity of the infrastructure used to steal credentials, it is likely the threat actor will have used a well known phishkit or phishing as a service tool (PhaaS) which will have provided ready to go infrastructure maintained by the owner of the service.

Here is a summary of the attack pattern utilized for these campaigns:

Infrastructure established

Multiple domains registered to host some of the stages of the redirect chain including the Cloudflare Captcha page and the final credential phishing page