Cofense Finds Phishing Campaigns Tailor Payloads to Victims’ Devices
Summary
Cofense reports that phishing campaigns fingerprint victims’ devices and browsers to tailor landing pages and payloads, including FleetDeck for macOS and Tiflux RAT for Windows. It recommends cross-platform monitoring and FIDO2 authentication.
Key points
- Cofense says some phishing campaigns gather browser, device, language, local-time, screen-size and geolocation data after a victim clicks.
- One observed campaign delivered FleetDeck to macOS users or Tiflux RAT to Windows users based on device fingerprinting.
- The article reports that Cloudflare user-agent blocking can redirect traffic based on a browser’s perceived operating system before the user reaches a malicious page.
- Phishing pages may imitate Google, Docusign, Microsoft Teams, Adobe or Zoom download screens based on collected telemetry.
- Cofense reports that attackers use Telegram to save or exfiltrate collected information and may repurpose legitimate remote-access tools as trojans.
- Recommended defenses include FIDO2 authentication, employee training, unified monitoring across Windows, Mac and mobile, and visibility into redirects and activity after a click.
Article Details
- Event Type
- Platform-aware phishing campaigns fingerprint victims’ devices and operating systems to tailor landing pages and payload delivery after a click.
- Impact
- The campaigns can collect victim and device information and deliver different payloads across platforms, including FleetDeck for macOS and Tiflux RAT for Windows. Cofense reports that attackers also use tools such as Telegram to exfiltrate information and may pursue credential theft or remote access, increasing the potential for compromise and attacker returns. No specific victim organization or confirmed incident impact is reported.
People
Malware
Vendors
Products
AndroidCofense found these attacks can serve different malware, disguise landing pages as trusted services, and increase attacker profits by adapting to Windows, macOS, Android, and other environments.macOSCofense found these attacks can serve different malware, disguise landing pages as trusted services, and increase attacker profits by adapting to Windows, macOS, Android, and other environments.Microsoft WindowsCofense found these attacks can serve different malware, disguise landing pages as trusted services, and increase attacker profits by adapting to Windows, macOS, Android, and other environments.