Google AMP Exploited in Phishing Attacks Targeting Enterprise Users

In 2024, phishing attacks accounted for over 36% of all data breaches globally, with sophisticated methods increasingly bypassing traditional security systems. One such tactic involves exploiting Google AMP (Accelerated Mobile Pages) to cloak malicious URLs under trusted Google domains, targeting enterprise users. In a notable incident, a multinational company suffered a breach via an AMP-based phishing attack, resulting in significant financial and reputational damage.

In this blog, we'll delve into how attackers exploit Google AMP, why these attacks are so effective, their challenges, and how to mitigate the risks with Keepnet's Redirect URL Analyzer.

What is Google AMP?

Google AMP is a framework designed to improve mobile web performance by hosting content on Google's servers. It enables faster page loading times by delivering streamlined versions of web pages, often used by publishers and enterprises to enhance user experience.

While beneficial for legitimate purposes, attackers leverage Google AMP's trusted infrastructure to bypass security measures, making it a prime target for exploitation.

How Attackers Exploit Google AMP in Phishing Campaigns

Google Accelerated Mobile Pages (AMP) is designed to enhance user experience by providing fast-loading mobile pages. However, cybercriminals are exploiting this feature to mask malicious URLs, making phishing campaigns appear more legitimate and bypass security filters:

Cloaking Malicious Links Behind Trusted Google Domains

Attackers disguise malicious links using Google AMP URLs, which often include "google.com" in their structure. When clicked, these links redirect victims to phishing pages while appearing credible due to the trusted Google domain.

For example, in 2024, a phishing campaign targeted employees of a large financial institution using Google AMP links. The attackers created fake login pages that mimicked the company's internal systems. Once employees entered their credentials, the attackers gained access to sensitive financial data, resulting in a significant breach.

Enhancing the Credibility of Phishing Pages

Phishing pages hosted on Google AMP domains inherit Google's SSL certificate, lending an additional layer of trust. This tactic significantly reduces skepticism among users, increasing the likelihood of successful credential harvesting.

Why Google AMP Phishing Attacks are Effective

Google AMP phishing attacks are effective because they leverage Google's trusted domain, making malicious URLs appear legitimate to users and security systems.

Bypassing Traditional Security Measures

Traditional email security tools often fail to flag Google AMP links as malicious, given their association with legitimate Google infrastructure. This enables attackers to infiltrate even well-guarded systems.

In the below example, the malicious link scanned by Virustotal is detected as malicious or phishing. But with Google’s AMP link, none of the security solutions marked this url as malicious.

2. Leveraging Trust in Google Infrastructure

Users are conditioned to trust Google domains, making them more likely to click AMP links without suspicion. This inherent trust is a cornerstone of Google AMP phishing success.

Challenges in Detecting Google AMP Exploitation

Difficulty in Identifying Malicious Intent

Google AMP URLs often redirect multiple times, making it difficult to identify the final malicious destination without sophisticated analysis tools. This allows attackers to obscure their intent effectively.

• Region-based restriction: Attackers apply location-based redirection.
• User-agent control: Specific user-agent restrictions.
• Sandbox detection: Identifies sandbox products and redirects URLs accordingly.
• JavaScript challenges: Implements advanced techniques to evade detection.

2. Limitations of Conventional Security Tools

Standard URL analysis tools often lack the capability to trace complex redirect flows, leaving organizations vulnerable to attacks leveraging AMP exploitation. Below examples show some challenges that conventional security tools couldn’t detect all URLs in the redirection chain.

• HTTP redirect URLs can be used to obscure malicious redirection without detection.
• Embedded URLs within links often evade detection during routine analysis.
• Meta Refresh redirects in page sources remain unidentified without advanced inspection tools.
• JavaScript-based redirection requires sophisticated emulation to detect.
• JavaScript execution often demands robust sandbox environments to ensure secure analysis, which many tools lack.

Analyze Phishing URL with Keepnet Incident Responder

Analyzing phishing URLs can be complex due to sophisticated obfuscation techniques used by attackers. Keepnet Incident Responder simplifies this process with advanced tools designed to detect hidden threats in redirect flows. Below, we will demonstrate a real-world phishing URL analysis using Keepnet Incident Responder, showcasing how it identifies and mitigates risks effectively.

Example of a Phishing URL Scan

Using the tool available at Free Phishing Analysis, you can analyze URLs and their redirect chains. The screenshot below illustrates an actual scan process, highlighting how the tool tracks and evaluates each redirection to uncover potential threats.

Mitigation and Prevention Strategies for Google AMP Phishing Campaigns

1 Security Awareness Training for Employees

Educating employees about the risks of clicking on links, even those appearing to originate from trusted domains, is essential. Comprehensive security awareness training can reduce human errors significantly.

2. Deploying Advanced Threat Detection Tools

Organizations need advanced tools capable of analyzing entire redirect flows. Keepnet Labs' Redirect URL Analyzer provides a cutting-edge solution by inspecting every URL in a redirect chain to identify malicious content.

How Keepnet's Incident Responder Works:

• Comprehensive Redirect Flow Analysis: Keepnet Incident Responder starts when a user reports an email using the Phishing Reporter button. The tool extracts URLs, attachments, and sender IP addresses from the email.
• Real-Time Threat Identification: It then communicates with analysis engines like VirusTotal, FortiSandbox, and Any. Run to gather intelligence. Additionally, with its redirect URL detection feature, it checks all URLs in the redirection chain, ensuring that no malicious link is overlooked.
• Seamless Integration: The insights from these analyses are integrated into existing security systems, significantly improving their effectiveness against sophisticated phishing attacks.

Using Keepnet’s Incident Responder, enterprises can stay ahead of attackers exploiting Google AMP, securing their digital environments effectively.