RTF-based phishing attacks explode as malicious emails and attachments look more trustworthy than ever

News
By
published

An ancient file type is helping crooks craft believable phishing emails

Phishing
(Image credit: Shutterstock)

Hackers have found a clever new way to abuse Rich Text Format (.RTF) files in phishing attacks, experts have warned.

Cybersecurity researchers Ironscales claim to have observed a “major spike” in these campaigns during 2024, and in the space of just one month (March 2024), the experts say they spotted, and stopped, 6,755 such attacks.

So what makes this attack so unique, and ultimately - successful? Three things, Ironscales says: the use of an outdated file format, attachment personalization, and URL obfuscation.

Attachment personalization

RTF files are quite uncommon these days, the researchers said, which means two things - victims are not that suspicious when they receive them in the email, and security solutions (especially traditional email security filters) don’t flag them as often.

So, when a threat actor sends a phishing email with an .RTF file attached, victims are somewhat more inclined to open it. Which led the researchers to the second point - attachment personalization. They say the criminals found a way to customize the file name in the email, to match the domain of the target recipient. Therefore, the attachment carries the name of the target company, boosting credibility.

Finally, URL obfuscation. In the .RTF file, the crooks would attach a link that “looks innocent enough”, and often appear to lead to a well-known site, such as microsoft.com. However, a clever use of the @ symbol allows them to redirect the victim to a malicious site, instead. The usual link in these files would look something like this: https://www.microsoft.com@malicious-site.com/invoice.pdf.

“In the world of URLs, anything before the @ is treated as a ‘username’ but can be written to look like a trusted domain,” the researchers explained. “The catch? The browser ignores everything before the @ and only cares about what comes after.”

In other words, if the victim is not carefully reading the entire link, they might think they’re visiting microsoft.com, but are instead being redirected elsewhere.

In conclusion, crooks are getting smarter, Ironscales argues, meaning organizations must do the same - or suffer the consequences.

More from TechRadar Pro

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.