Tweet

Phishers are now into TinyURLs, using the popular Web service to shrink long URL strings and hide destinations from users. Trend Micro Advanced Threats Researcher Joey Costoya discovered a malicious shortened link hidden in this spammed message:

Figure 1. Sample spam.

The link may look legitimate but it masks a TinyURL that leads to the following malicious page:

Figure 2. Phishing page.

This is a fake website of Liberty Reserve, a company with services including online payments. The information entered by unknowing users in the login boxes is logged and stolen by cyber criminals.

The cyber criminal advantage of using TinyURL is that when this link is used in spammed email messages the exact URL of the destination is concealed from users until they land on the page itself. Recipients may then be tricked into clicking URLs purporting to be shortened versions of whatever company the spammer has chosen. Spam filter evasion is another key advantage.

The good practice here is to first substitute preview.tinyurl.com for tinyurl.com to get a preview of the final link before one proceeds to the page itself. The best advice is to altogether avoid clicking on links in unsolicited email.

Trend Micro Smart Protection Network already blocks the phishing spam and URL.