Phishing attacks abusing SaaS platforms see a massive 1,100% growth

Threat actors are increasingly abusing legitimate software-as-a-service (SaaS) platforms like website builders and personal branding spaces to create malicious phishing websites that steal login credentials.

According to a new report by Palo Alto Networks Unit 42, researchers have seen a sharp rise in this abuse, with the data collected by the firm showing a massive increase of 1,100% from June 2021 to June 2022.

The advantages of using SaaS for phishing include evading alerts from email security systems, enjoying high availability, and bypassing the need to learn how to code to create websites that appear legitimate.

Also, because SaaS platforms simplify and streamline the process of creating new sites, phishing actors can easily switch to different themes, scale up or diversify their operations, and quickly respond to reports and takedowns.

Services abused for phishing

Unit 42 has divided the abused platforms into six categories: file sharing and hosting sites, form and survey builders, website builders, note-taking and documentation writing platforms, and personal portfolio spaces.

Palo Alto Networks filtering systems recorded a growth in the abuse across all categories, but the most significant were website builders, collaboration platforms, and form builders.

Also, the stats indicate a notable rise in October 2021, based mainly on the sudden uptick in the abuse of form builders.

In 2021, Cyren reported about the rampant abuse of "typeform.com" for phishing, an older report from Trend Micro mentioned "123formbuilder.com", "formtools.com", and "smartsurvey.co.uk", while Cofense highlighted the abuse of "Canva.com".

Around the same time, another uptick was spotted, augmented by the abuse of a personal branding site the report doesn't name.

How the services are used

The Unit 42 report explains that in many cases, the phishing actors host their credential stealing pages directly on the abused services, so they send an email to targets containing a URL leading to the page.

In other cases, however, the landing pages hosted on the abused services don't contain the credential-stealing forms themselves. Instead, they take the victim through one more redirection step to another site.

The phishing site can be hosted on a bulletproof service provider that doesn't respond to takedown requests, so the phishing actors follow that practice to increase campaign uptime while sacrificing the conversion rate.

Even if the phishing page isn't well protected, hiding it behind one more layer reduces the labor required to set everything up again in the case of a takedown.

"In the event that the final credential-stealing page is taken down, the attacker can simply change the link and point to a new credential-stealing page, preserving the effectiveness of the original campaign," reads the report.

Not going away anytime soon

Stopping the abuse of legitimate SaaS platforms will be very hard, as implementing aggressive email filters against those services isn't a choice.

That's precisely what makes them so suitable for phishing campaigns and why the rise in its abuse since last year has been so startling.

If a message that makes bold claims or requests urgent action from you lands in your inbox, avoid clicking embedded links or buttons, but instead use a search engine to locate the official site of the potentially spoofed platform.

Whenever you're requested to enter your account credentials, ensure that you are on the legitimate website URL before you start typing in the form boxes.