Seraphim Digital Technology

Attackers are launching phishing campaigns using an open-redirect vulnerability affecting a website belonging to coffee machine company Nespresso, according to researchers.

Open-redirect vulnerabilities enable attackers to send users to phishing sites via seemingly benign links. In this case, the attackers are sending emails that appear to be multi-factor authentication requests from Microsoft.

"This attack starts with an email," the researchers explain. "Albeit in this instance a very strange email that at first glance appears to be a multi-factor authentication request from Microsoft. The email sender is unaffiliated with Microsoft.

"At the bottom of the message it seems that the email has been forwarded twice. This creates a rather muddled message that the attacker likely fabricated entirely. Perhaps the intent of the 'forwarding' was to provide an explanation as to why the email doesn't originate from Microsoft. Regardless of the convoluted details, the overall message is clear."

If the user clicks the link, they'll be sent to a phony Microsoft login page designed to steal their credentials.

"The email urges the recipient to check their recent login activity," the researchers write. "Upon clicking the link, the user is first directed to the infected Nespresso URL, followed by a redirection to an .html file. The goal of using the Nespresso open redirect vulnerability is to evade security measures.

"Attackers know that some security vendors only inspect the initial link, not digging further to discover any hidden or embedded links. With this knowledge, it makes sense that the attacker would host the redirect on Nespresso, as the legitimate domain would likely be sufficient to bypass many security vendors, detecting only the reputable URL and not the subsequent malicious ones."

Attackers are launching phishing campaigns using an open-redirect vulnerability affecting a website belonging to coffee machine company Nespresso, according to researchers.

Open-redirect vulnerabilities enable attackers to send users to phishing sites via seemingly benign links. In this case, the attackers are sending emails that appear to be multi-factor authentication requests from Microsoft.

"This attack starts with an email," the researchers explain. "Albeit in this instance a very strange email that at first glance appears to be a multi-factor authentication request from Microsoft. The email sender is unaffiliated with Microsoft.

"At the bottom of the message it seems that the email has been forwarded twice. This creates a rather muddled message that the attacker likely fabricated entirely. Perhaps the intent of the 'forwarding' was to provide an explanation as to why the email doesn't originate from Microsoft. Regardless of the convoluted details, the overall message is clear."

If the user clicks the link, they'll be sent to a phony Microsoft login page designed to steal their credentials.

"The email urges the recipient to check their recent login activity," the researchers write. "Upon clicking the link, the user is first directed to the infected Nespresso URL, followed by a redirection to an .html file. The goal of using the Nespresso open redirect vulnerability is to evade security measures.

"Attackers know that some security vendors only inspect the initial link, not digging further to discover any hidden or embedded links. With this knowledge, it makes sense that the attacker would host the redirect on Nespresso, as the legitimate domain would likely be sufficient to bypass many security vendors, detecting only the reputable URL and not the subsequent malicious ones."