The Spamhaus Project
@spamhaus@infosec.exchange
Spamhaus strengthens trust and safety for the Internet. Advocating for change through sharing reliable intelligence and expertise. As the authority on IP and domain reputation data, we are trusted across the industry because of our strong ethics, impartiality, and quality of actionable data. This data not only protects but also provides signal and insight across networks and email worldwide. With over two decades of experience, our researchers and threat hunters focus on exposing malicious activity to make the internet a better place for everyone. A wide range of industries, including leading global technology companies, use Spamhaus' data; currently protecting over 4.5 billion mailboxes worldwide.
infosec.exchange
❗We're tracking a spam campaign that abuses cross-site scripting (XSS) flaws in website search forms to funnel victims to phishing and scam pages.
Here's what we've confirmed so far:
➡️ Spam emails, mainly from compromised accounts, many on Microsoft 365 (*.onmicrosoft.com), linking to legitimate sites whose search forms are vulnerable to XSS.
➡️ The links carry a hidden payload using a classic technique: an ![]()
tag pointing to a non-existent file, with the onerror handler carrying the actual JavaScript.
➡️ That script redirects the visitor to a landing site. The landing site itself applies restrictive geo/browser filtering,behavior similar to a traffic distribution system (TDS), but handled by the site itself rather than a separate redirect service.
➡️ Visitors who don't match the target profile get sent to a random Wikipedia article.
➡️ Most landing pages we've seen promote an "AI-powered" investment product, using the .mom TLD - though we've also seen .beauty, .skin, .makeup, .click, and .com.
➡️ We've also observed banking phish delivered through the same mechanism, along with other, less common target types.
We're listing the abused (legitimate) sites as abused-legit and notifying operators so they can patch the vulnerable form.
🕵️♂️ While digging into this, we found two other threads that use a similar spammer modus operandi, but we haven't yet confirmed if they are connected:
➡️ A campaign targeting Dutch recipients from early July, using similar tactics.
➡️ A separate lure impersonating a Zoom meeting invite, leading to a fake "client update" page that serves a .vbs file.
We're not asserting that they are the same actor, but it's worth watching out for this pattern.
Note, this is early-stage research, and we'll share more as we learn...
#ThreatIntel #XSS #Phishing #InfoSec #Cybercrime #WebSecurity #Scam
