Bubble’s role in phishing scams | Kaspersky official blog
Source Kaspersky Security Blog
United States
United Kingdom
Germany
France
Canada
Australia
India
Japan
Brazil
Netherlands
Italy
Spain
South Africa
Mexico
Turkey- web
Description
The Tycoon phishing kit has introduced new functionality to create redirect web apps with the help of Bubble.
Impact
This threat poses a significant risk to organizations worldwide, particularly those relying on Microsoft services for corporate authentication. Successful credential theft can lead to unauthorized access to sensitive corporate resources, data breaches, and lateral movement within networks. The use of legitimate hosting platforms like Bubble.io and Cloudflare complicates detection, increasing the likelihood of phishing emails reaching end users and users interacting with malicious sites. This can result in compromised employee accounts, potential financial losses, reputational damage, and regulatory consequences. The integration of this technique into phishing-as-a-service platforms means attacks can be rapidly deployed at scale, targeting multiple organizations simultaneously. While the threat requires user interaction (credential submission), the sophisticated evasion tactics increase the chance of successful exploitation, especially against less security-aware employees or organizations lacking advanced email and web filtering solutions.
Defensive guidance
Organizations should implement multi-layered defenses tailored to this threat. First, enhance security awareness training focusing on the risks of entering credentials on unfamiliar or suspicious sites, emphasizing verification of URLs even when hosted on seemingly legitimate domains like Bubble.io. Deploy advanced email gateway solutions with heuristic and behavioral anti-phishing capabilities that can detect indirect redirects and obfuscated code patterns typical of no-code generated apps. Utilize endpoint protection platforms capable of blocking access to known malicious domains and suspicious redirect chains. Implement strict URL filtering policies that scrutinize third-party no-code platform domains used in unexpected contexts. Employ multi-factor authentication (MFA) methods resistant to adversary-in-the-middle attacks, such as hardware tokens or FIDO2 standards. Monitor for unusual login patterns and implement anomaly detection to identify compromised credentials quickly. Collaborate with threat intelligence providers to stay updated on emerging phishing kits and infrastructure. Finally, consider restricting or monitoring the use of no-code platforms within corporate environments to prevent misuse.
References
Community reviews
Related threats
- Online ad firm Adform’s script compromised to steal cryptocurrencyBreach
- Read This Before You Buy That TV Streaming StickMalware
- Canada’s Bill C-8 is here: Why the 72-hour reporting rule will redefine critical infrastructure securityCriticalVulnerability
- Russian hackers exploit Exchange OWA zero-day for long-term mailbox accessThreat Actor
- ScreenConnect leveraged in cyberattacks | Kaspersky official blogPhishing