AUTOMATIC EMAIL SENDER YT PASSWORD
AUTOMATIC EMAIL SENDER YT SERIES

When Outlook is setup to send automatic replies, you'll see a message under the ribbon with this information. If you want to send automatic replies to those outside your organization, we recommend choosing My contacts only. One way to counter the problem would be for email gateway filters to treat YouTube redirect links with more suspicion, rather than assume that any link pointing to is going to keep the user at .īut ideally I would like to see Google tighten up how it checks redirect links to prevent them from being abused by attackers in phishing attacks like this.Įditor’s Note: The opinions expressed in this guest author article are solely those of the contributor, and do not necessarily reflect those of Tripwire, Inc.Note: Sending automatic replies to anyone outside my organization will send your automatic reply to every email, including newsletters, advertisements, and potentially, junk email. &redir_token=&event=video_description&v=Īs researchers have noted before, the system can be exploited to trick users if a valid token is taken from a legitimate YouTube redirect link and then used in a malicious campaign. Just check the descriptions of different videos, and when they contain a link hover your mouse over it to see where it will take you.Ī YouTube video with a description containing a link will actually follow this format: If you’re a regular user of YouTube you may already have seen this redirect facility in use. In contrast, an email which had linked directly to a phishing page might have been less successful at waltzing past email security solutions.

The disappointing truth is that YouTube provides a method for anyone to create a link at, which automatically redirects browsers to third-party phishing sites without any warning.Īnd because email gateways typically whitelist popular domains such as, , and other social media sites it’s a highly effective way for attackers to get their malicious links in front of innocent users. The main differences are: the box surrounding the login is black instead of white the small detail of the banner at the bottom has different information than Microsoft’s actual login and the copyright year is showing as 2019.

Nothing appears amiss–in fact, it is almost a perfect replica.

AUTOMATIC EMAIL SENDER YT PASSWORD

The username field of the login page is automatically populated with the target’s email address, and any password entered is automatically sent to criminals.Īgain, it’s easy to understand why users would believe the webpage to be genuine.Īccording to Cofense, it will not be obvious to most users that anything about the page is suspicious:

In the attacks seen by Cofense’s research team, the phishing page poses as a harmless-looking Microsoft login page.

AUTOMATIC EMAIL SENDER YT SERIES

To the untrained eye the email may appear legitimate, and an unwary user might click on the link contained inside the email without proper due care and attention.Ī more cautious user might have hovered their mouse cursor over the link within the email, and found that it actually took them via YouTube.Ĭloser examination reveals that although the link in the email does indeed point initially at YouTube (), it also sends a series of parameters telling YouTube to redirect any traffic to a URL at sharepointonline-ertpw, which in turn ultimately takes the user’s browser to its final destination: a phishing page hosted on a legitimate Google site,. In the attack, an unsuspecting user receives an email which purports to come from SharePoint, claiming that a new file has been uploaded to his company’s SharePoint site. Researcher Ashley Trans of Cofense highlighted the threat in a blog post describing a recent phishing campaign. Attackers are increasingly exploiting the fact that email gateways turn a blind eye to links to popular sites such as YouTube, in order to phish passwords from unsuspecting computer users.

Automatic email sender yt