Attackers Abuse Kuse AI Sharing Links to Host Credential-Stealing Phishing Lure
Summary
Attackers used a compromised vendor mailbox to send phishing links to a blurred Markdown document hosted on Kuse.ai, which redirected users to a fake Microsoft login page to steal credentials.
Key points
- A compromised vendor mailbox was used to send a targeted phishing email, exploiting trust between the vendor and recipient organization.
- Attackers hosted a fake, blurred Markdown document through Kuse.ai’s legitimate sharing feature, using a vendor name in the URL to make it appear genuine.
- The lure prompted users in Spanish to click through to view the document, then redirected them to a fake Microsoft login page that collected credentials.
- The use of a legitimate platform and uncommon .md file extension was intended to evade user scrutiny and some email filtering.
- The article recommends verifying unexpected links, treating vendor email as potentially compromised, using phishing-resistant MFA, monitoring AI-platform sharing, and applying time-of-click URL filtering.
- The article lists an IP address and a Kuse shared-note URL pattern as indicators of compromise.
Article Details
- Attack Vectors
- A compromised vendor mailbox was reportedly used to send a phishing email, exploiting the existing trust between the organizations.
- The email linked to a fake document hosted through Kuse's sharing feature. A blurred preview and a Spanish call to action prompted users to follow a link to a fake Microsoft login page and provide credentials.
- Defensive Notes
- Train users to recognize vendor email compromise, AI-platform abuse, and blurred-document lures, regardless of the hosting platform's reputation.
- Verify unexpected links and scrutinize the full URL path; use secondary verification for unusual vendor requests involving links or credentials.
- Use phishing-resistant MFA such as FIDO2/WebAuthn, and monitor or restrict AI-platform sharing links where appropriate.
- Use email and URL filtering that checks links at click time, including URL sandboxing and real-time reputation checks.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 91[.]92[.]41[.]64 | Listed in the article's Indicators of Compromise section. |
| URL | hxxps[:]//app[.]kuse[.]ai/sharednote/<victimcompany>%20S.L..md/shared_3049184.md | Specific Kuse-hosted phishing document URL listed as an IOC; the article says attackers abused the sharing feature to host the fake document. |
| URL | hxxps[:]//onlineapp[.]ooraikaoo[.]info/?auth2=8rf22euu-2nxkebabDjjILlzldhQq2Pz | URL of the fake Microsoft login page used to collect credentials. |