⚠️ Advanced Phishing Alert
This is a sophisticated cyberattack targeting employees of a specific organization (Grupo Energía Bogotá). It uses “trust-building” techniques to steal corporate login credentials and bypass security measures.
1. The Strategy: The “Bait and Switch”
The attacker shares a shortened URL that appears to lead to a legitimate, harmless resource — in this case, a corporate benefits platform (Gointegro) showing discounts for books in Bogotá. Because the destination looks familiar and non-threatening, employees are more likely to click.
2. The Trap: Forced Re-authentication
Once the user clicks the link, they are automatically redirected to Microsoft login page.
The user is redirected to a GENUINE Microsoft login page, but the session is hijacked.
How it works (Technical Explanation):
The Proxied Redirect: The link isn’t just a simple redirect. It acts as a proxy.
The attacker uses a trusted corporate link to initiate a legitimate login process, but controls the redirection path. Once you successfully log in to the real Microsoft portal, the system sends your authentication token back to the attacker’s infrastructure, allowing them to hijack your corporate session without ever knowing your password.
Bypassing MFA: Because the site is real, Microsoft sends a Multi-Factor Authentication (MFA) code to the user. The user enters it, thinking everything is fine. The attacker then steals the Session Cookie (the digital “key” that says you are logged in).
Full Access: With that stolen cookie, the hacker can enter the victim’s account without needing the password or the MFA code again. They are “in” as the user, bypassing all modern security layers.
Even if the login page looks 100% official (because it is), the path you took to get there was compromised. Attackers use shortened links and ‘trusted’ third-party sites to wrap the official login process in a malicious layer that steals your access token the moment you sign in.
The Psychological Trick: Users often assume their “session has expired” and instinctively enter their username and password to continue to the “discounts” they were promised.
3. Technical Red Flags:
- Unauthorized Redirects: A link for “book discounts” should never suddenly ask for your Microsoft password. This is a primary sign of a Credential Phishing attack.
- Suspicious Source: These links are often distributed via unofficial channels (personal WhatsApp, social media, or external emails) rather than official company communications.
- Abuse of URL Shorteners: Attackers use URL shorteners to hide the final destination and to bypass corporate email filters that would otherwise block direct links to phishing sites.
4. The Goal: Corporate Espionage & Ransomware
By capturing these credentials, hackers can:
- Gain access to the company’s internal network and sensitive data.
- Perform AiTM (Adversary-in-the-Middle) attacks to intercept Multi-Factor Authentication (MFA) tokens.
- Spread ransomware or conduct financial fraud within the organization.
5. How to Protect Yourself and Your Company:
- Never trust “Login” prompts from external links: If a link unexpectedly asks for your password, close the tab immediately.
- Verify via the Official Portal: Always log in through your company’s official bookmarks or by typing the address directly into your browser.
- Report Suspicious Links: If you see a shortened URL claiming to be a corporate resource, report it to your IT Security department before clicking.
🛡 Note for Security Professionals:
This attack is particularly dangerous because it originates from the same geographic location (Bogotá) as the victim company, making it appear “local” and less suspicious. For a moderation system, the key is to implement Deep Redirect Inspection — following the link to its final destination and flagging any unauthorized jumps from a “safe” site to a login portal.
