A sophisticated phishing campaign dubbed “Gabagool” that targets corporate and government employees has been uncovered recently by the TRAC Labs team.

This campaign exploits Cloudflare’s R2 storage service to host malicious content, leveraging Cloudflare’s trusted reputation to evade security filters.

The attack begins with compromised mailboxes sending phishing emails to other employees. These emails contain an image disguised as a document with an embedded malicious URL-shortened link.

When clicked, users are redirected through a chain of file-sharing platforms before landing on a Cloudflare R2 bucket page.

TRAC Labs team researchers discovered that the phishing landing page is hosted on a Cloudflare R2 bucket with a URL format: pub-{32 hexadecimal characters}.r2.dev/{html_filename}.html.

This setup allows attackers to bypass security measures by utilizing Cloudflare’s trusted infrastructure.

Maximizing Cybersecurity ROI: Expert Tips for SME & MSP Leaders – Attend Free Webinar

Technical Analysis

Gabagool employs various methods to detect and evade bot activity:

Webdriver checks
Mouse movement detection
Cookie tests
Rapid interaction detection

If bot activity is suspected, the user is redirected to a legitimate domain. Otherwise, the phishing page is loaded after a 2-second delay.

The phishing page uses AES encryption to protect its server address. It captures user credentials and sends them to the attacker’s server (o365.alnassers.net) for harvesting.

Gabagool can handle various multi-factor authentication (MFA) methods, including:

PhoneAppNotification
PhoneAppOTP
OneWaySMS
TwoWayVoiceMobile
TwoWayVoiceOffice

This capability allows the attackers to potentially bypass MFA protections.

To detect Gabagool attacks, security teams should:

Monitor for unusual connections to Cloudflare R2 buckets
Watch for traffic to known malicious servers like o365.alnassers.net
Review network traffic data sent to suspicious servers
Utilize public URLScan queries to identify potential threats

Besides this, researchers urged that organizations must remain vigilant and adapt their security measures to protect against sophisticated campaigns like Gabagool.

Are you from SOC/DFIR Teams? – Analyse Malware Files & Links with ANY.RUN -> Try for Free

The post Gabagool Leveraging Cloudflare’s R2 Storage Service To Bypass Security Filters appeared first on Cyber Security News.