November 19, 2021
The DomainTools research team has uncovered a phishing campaign that actively exploits the Glitch platform to display short-lived phishing site URLs.
To bypass antivirus security, actors send emails with attachments to PDF documents that do not contain malicious code, but the PDFs contain a link that directs the user to a site hosted by Glitch.
A careful examination of these PDF links shows that they contain JavaScript, which is used to steal credentials to an email address after being forwarded via compromised WordPress pages. Further revelations show that Glitch is just one of several channels that the threat actors use to bypass detection and steal credentials.
Other sites where the hackers host similar documents include Heroku, SelCDN.
Glitch is a cloud hosting service that allows people to deploy apps and websites using Node.js, React and other development platforms. However, factors such as the favourable view Glitch enjoys from security platforms, short-lived URLs and the fact that threat actors could host them for free make Glitch an excellent target for abuse.
For more information, read the original story in Bleeping Computer.
