GlobalGuard is intercepting a new phishing campaign impersonating telecommunications provider AT&T that attempts to steal victims' personal information and payment card details.
Unlike many phishing campaigns that rely solely on deceptive emails, this attack abuses an open redirect vulnerability on a legitimate website to disguise the malicious destination. This technique can help malicious links evade traditional reputation-based security controls and make them appear more trustworthy to recipients.
The phishing email claims that the recipient's latest AT&T payment has failed and warns that their account is at risk of service interruption unless payment information is updated within 48 hours. The message states that the recipient's payment method has expired or is no longer valid and urges immediate action by clicking a prominent "UPDATE PAYMENT METHOD HERE" button.
Example phishing content shown using AT&T branding. Not affiliated with AT&T.
The email attempts to create urgency by warning that failure to act could result in service disconnection. Rather than linking directly to a phishing website, however, the attacker first sends recipients through a compromised URL that abuses an open redirect parameter on a legitimate third-party website. If the requested page cannot be found, the website automatically redirects the victim to the attacker-controlled phishing page. This additional layer of indirection helps disguise the true destination of the malicious link and can reduce suspicion from both users and automated security tools.
Recipients who click the link are taken to a convincing website branded as AT&T Wireless.
The fraudulent page requests an extensive range of personal and financial information, including:
• First and last name
• Billing address
• City, state and ZIP code
• Phone number
• Social Security Number (or EIN)
• Credit card number
• Card expiry date
• CVV security code.
Collecting this breadth of information allows cybercriminals to do much more than commit payment card fraud. The information can be used to facilitate identity theft, account takeover attacks, financial fraud and future phishing campaigns.
After victims submit their information, the phishing site immediately redirects them to the legitimate AT&T website. This tactic is designed to reduce suspicion by making it appear as though the payment update was completed successfully.
Several aspects of this campaign demonstrate a higher-than-average level of sophistication. Most notably, the attackers abuse a legitimate website's redirect functionality rather than hosting a direct phishing URL in the email. By exploiting the "noSuchEntryRedirect" parameter, recipients are silently redirected to the phishing page after first visiting what appears to be a legitimate domain.
The emails also personalise the sender information by displaying "AT&T My Account", while manipulating the sender details so they appear more believable to recipients.
Combined with a professionally designed phishing page and post-submission redirection to the genuine AT&T website, these techniques create a seamless experience intended to minimise user suspicion.
GlobalGuard advises all recipients of these emails to delete them immediately without clicking on any links. Responding or providing personal details can lead to identity theft, data breaches, and financial losses.
Reach out to speak to a GlobalGuard expert about securing your inboxes against advanced, malicious email-borne threats with our AI-powered email security solutions.