AT&T phishing campaign exploits website redirect vulnerability

MailGuard is intercepting a new phishing campaign impersonating telecommunications provider AT&T that attempts to steal victims' personal information and payment card details.

Unlike many phishing campaigns that rely solely on deceptive emails, this attack abuses an open redirect vulnerability on a legitimate website to disguise the malicious destination. This technique can help malicious links evade traditional reputation-based security controls and make them appear more trustworthy to recipients.

How the Scam Works

The phishing email claims that the recipient's latest AT&T payment has failed and warns that their account is at risk of service interruption unless payment information is updated within 48 hours.

The message states that the recipient's payment method has expired or is no longer valid and urges immediate action by clicking a prominent "UPDATE PAYMENT METHOD HERE" button.

Example phishing content shown using AT&T branding. Not affiliated with AT&T.

The email attempts to create urgency by warning that failure to act could result in service disconnection.
Rather than linking directly to a phishing website, however, the attacker first sends recipients through a compromised URL that abuses an open redirect parameter on a legitimate third-party website. If the requested page cannot be found, the website automatically redirects the victim to the attacker-controlled phishing page.
This additional layer of indirection helps disguise the true destination of the malicious link and can reduce suspicion from both users and automated security tools.

Fake Payment Page Harvests Sensitive Information

Recipients who click the link are taken to a convincing website branded as AT&T Wireless.

The fraudulent page requests an extensive range of personal and financial information, including:
•    First and last name
•    Billing address
•    City, state and ZIP code
•    Phone number
•    Social Security Number (or EIN)
•    Credit card number
•    Card expiry date
•    CVV security code

Example phishing content shown using AT&T branding. Not affiliated with AT&T.

Collecting this breadth of information allows cybercriminals to do much more than commit payment card fraud. The information can be used to facilitate identity theft, account takeover attacks, financial fraud and future phishing campaigns.

After victims submit their information, the phishing site immediately redirects them to the legitimate AT&T website. This tactic is designed to reduce suspicion by making it appear as though the payment update was completed successfully.

Sophisticated Delivery Techniques

Several aspects of this campaign demonstrate a higher-than-average level of sophistication. Most notably, the attackers abuse a legitimate website's redirect functionality rather than hosting a direct phishing URL in the email. By exploiting the "noSuchEntryRedirect" parameter, recipients are silently redirected to the phishing page after first visiting what appears to be a legitimate domain.

The emails also personalise the sender information by displaying "AT&T My Account", while manipulating the sender details so they appear more believable to recipients.

Combined with a professionally designed phishing page and post-submission redirection to the genuine AT&T website, these techniques create a seamless experience intended to minimise user suspicion.

Stay Safe, Know the Signs

MailGuard advises all recipients of these emails to delete them immediately without clicking on any links. Responding or providing personal details can lead to identity theft, data breaches, and financial losses.

Avoid emails that:

• Aren’t addressed to you personally.
• Are unexpected and urge immediate action.
• Contain poor grammar or miss crucial identifying details.
• Direct you to a suspicious URL that isn’t associated with the genuine company.

Many businesses turn to MailGuard after a near miss or incident. Don't wait until it's too late. Reach out to our team for a confidential discussion by emailing expert@mailguard.com.au or calling 1300 30 44 30.

One Email Is All That It Takes   

All that it takes to devastate your business is a cleverly worded email message that can steal sensitive user credentials or disrupt your business operations. If scammers can trick one person in your company into clicking on a malicious link or attachment, they can gain access to your data or inflict damage on your business.     

For a few dollars per staff member per month, you can protect your business with MailGuard's specialist AI-powered, zero-day email security. Special Ops for when speed matters!  Our real-time zero-day, email threat detection amplifies our client’s intelligence, knowledge, security and defence. Talk to a solution consultant at MailGuard today about securing your company's inboxes.  

Stay up-to-date with MailGuard's latest blog posts by subscribing to free updates. Subscribe to weekly updates by clicking on the button below.