PhishLabs researchers, in collaboration with Anti-Phishing Working Group (APWG), have begun a campaign to track malicious sites on the Internet protected by the HTTPS encryption protocol, used to secure online communications by applying encryption to data exchanged between the user’s browser and the website.
APWG is an international effort in which large corporations, law enforcement agencies and security solution developers collaborate to strengthen the fight against phishing and other similar attack variants.
The use of this protocol is especially important on e-commerce websites or where password-protected accounts are used. Threat actors have found a way to use this tool for their own benefit, tricking users into believing that they visit safe sites when they are actually visiting phishing platforms.
John LaCour, researcher and co-founder of PhishingLabs mentions in his report: “The number of phishing sites using security tools has increased considerably and will continue to do so; because most websites use TLS, threat actors are committing legitimate websites to inadvertently place malicious content for victims.”
According to the researcher, during the second quarter of 2020 the number of phishing websites using a certificate increased by 77.6% compared to the previous quarter. The worst part is that more than 35% of the certificates detected on malicious websites were issued by Let’s Encrypt, the most recognized certification authority.
LaCour also mentions that more than 90% of the certificates used in phishing attacks are validated domain certificates, and that 27 external validation websites were detected, representing a much larger risk scenario.
Obtaining such certificates requires validation of the legal identity of applicants; a threat actor cannot obtain this external validation certificate by itself, so detecting these phishing sites involves deploying a much more ambitious hacking campaign and with the ability to seriously compromise the resources of a legitimate company.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
