How Unsubscribe Links Can Be Turned Into a Phishing Attack

Based on an article by Morey Haber, Chief Security Officer at BeyondTrust

Security awareness training and phishing-based penetration tests are standard parts of a mature security management programme, and they shield an organisation from a wide range of threats. Morey Haber, chief security officer at BeyondTrust, points out that plenty of products exist to automate these tests and measure how often emails are detonated, but whether a test works depends entirely on what the emails say. Samples that are plainly fake will draw few clicks.

Targeted samples with hardly any spelling errors, carrying the hallmarks of spear-phishing or whaling, should produce far more clicks and detonations. Haber sees a weakness in this method all the same. A phishing test is usually a one-off: a single campaign that captures one moment. Tests seldom send a run of similar messages that, over time, teach the recipient to trust how often they arrive and what they contain, even though that is exactly how some real attacks work. One highly effective example abuses the unsubscribe option found in many marketing emails, turning it into a watering hole attack that harvests credentials.

How the unsubscribe trap works

Haber starts from his own inbox. Like clockwork, marketing emails arrive from vendors he likes, selling furniture, clothing and electronics, almost daily and at roughly the same hour. Every one has an unsubscribe button. After a click, some sites ask the user to log in before changing preferences, while others do not. Haber treats any site that demands a login as a warning sign: if the email was a phish to begin with, a request for credentials may be the attack itself. There is no good reason, he argues, for anyone to sign in just to manage what emails they receive.

He then describes how such an attack could be run against employees as an ongoing campaign:

1. Take the daily spam from a well-known vendor and paste its content into a phishing penetration tool, every day.
2. Point the unsubscribe link at a fake login page, the watering hole. Most phishing tools can build a convincing one of these without extra work and tailor it to look genuine.
3. Send the email to targets several times a day, and refresh the content daily to match the vendor's latest promotions.
4. Anyone who clicks a product link lands on a real product, so the email seems authentic.

Before long, recipients tire of the volume and hit unsubscribe out of pure annoyance. If they then type in their credentials or trigger another payload, the attacker has taken over their account on that site.

Why a series of emails beats a single test

Haber admits the scheme is devious. He uses it to make a point about cyber education and phishing: training and testing tend to happen at one moment rather than continuously. Even where phishing tests do run continuously, many never send a sequence of connected emails designed to wear the user down until they fall for one. In his opinion, sequences like that are among the most successful attacks there are.

What makes them work is continuity. The user comes to expect the email, which builds a baseline of trust, and those expected messages are the ones employees are most likely to click. Unsubscribe is only a simple illustration, and response rates will differ. Haber's clear conclusion is that staff trust emails they are used to seeing regularly and are more likely to act on them than on a one-time attack or test.