Security researchers are warning of an ongoing mobile-aware phishing campaign targeting the United Nations and various NGOs for Okta, Office 365 and Outlook account credentials.
The two domains hosting the phishing content have been live since March 2019, with most of the the SSL certificates used valid in two main date ranges: May 5-August 3, 2019, and June 5-September 3, 2019, according to Lookout.
Interestingly, Javascript on the phishing pages can detect if the user is on a mobile device, and deliver relevant content to them. Lookout warned that mobile browsers typically truncate URLs, which can help phishing attempts by making it harder for users to spot any deception.
“The mobile-aware component found in this campaign is further proof that phishing attacks have evolved to target mobile devices,” the vendor explained.
“Mobile phishing has emerged as a source of increasing risk for enterprises, as the post-perimeter world and widespread adoption of bring your own device (BYOD) policies blurs the lines between personal devices and corporate networks, not to mention the expanded multi-channel threat surface presented by such devices and mobility as a whole.”
Those behind the campaign have also installed keylogging functionality to record keystrokes in the password field of the pages. This means that even if a victim, for some reason, decides not to hit the login button, the hackers will still have harvested their credentials.
At the time of writing, Lookout claimed that six of the SSL certificates used in the campaign are still valid, and targeting organizations including the UN World Food Programme, UNICEF, Heritage Foundation and the International Federation of the Red Cross and Red Crescent Societies.
Other organizations targeted in the campaign include the United State Institute of Peace, Concern Worldwide and UC San Diego.