Connect with us

Hi, what are you looking for?



RSA Uncovers Ultra-Targeted “Bouncer List” Phishing Attacks

Researchers from EMC’s RSA Security division have identified a new phishing technique, which targets a very specific group of victims in targeted attacks.

Researchers from EMC’s RSA Security division have identified a new phishing technique, which targets a very specific group of victims in targeted attacks.

“Bouncer list phishing” refers to how attackers focused the campaign to steal credentials from a pre-determined list of victims, Limor Kessem, cybercrime and online fraud communications specialist at RSA, wrote Tuesday on the RSA FraudAction Research Labs blog.

BouncerAttackers using this “unusual” kit began with a list of email addresses and assigned a unique user ID to each of the targeted recipients. When a user clicked on the attack URL, the kit first validated the ID to determine whether the user was on the list of victims being targeted. Those who failed validation never saw the phishing page, Kessem wrote.

Attackers would primarily adopt this technique in order to gain “quality” data by focusing on desirable victims, Daniel Cohen, head of business for online threats, told SecurityWeek. While RSA has seen campaigns filtering out victims before, the older methods generally used IP addresses to separate victims by geographic region. This is the first time an “invitee list was brought into play,” Cohen said.

“Much like many high-profile nighttime hotspots—if your name is not on the list, you’re staying out!” Kessem said.

When victims attempt to access the phishing page, the kit validates the ID “on the fly” to ensure the user is on the list. Only the unfortunate victims who make the cut get directed to the phishing page; “unintended visitors” are shuffled off to a “404 page not found” page, Kessem said. The kit doesn’t even bother to generate the attack page for the unwanted visitors.

As soon as the bouncer kit identifies a desirable victim, it copies pertinent files into a temporary folder on the same Web server as the original attack website and loads the phishing page. After harvesting the credentials, the victim is redirected to yet another hijacked website.

“Keeping out uninvited guests also means avoiding security companies and prompt takedowns of such attacks,” Kessem said.

Advertisement. Scroll to continue reading.

RSA researchers have observed attacks using the bouncer list phishing against a South African financial institution and other organizations in Australia and Malaysia, Cohen said. The attack against the South African company targeted only users with email addresses on the domain, Cohen said.

Each campaign targeted an about 3,000 victims on average, with lists composed in alphabetical order, Kessem said. There were separate lists for emails beginning with each letter of the alphabet. Victims were a “mixed bag,” and included webmail users, corporate addresses, and even some bank employees. It is likely the target list was compiled by aggregating a few spam lists or data breach collections, Kessem said.

“These kits, used to target corporate email recipients, can easily be part of spear phishing and the foothold of a looming APT-style attack,” Kessem warned. This phishing method varies from traditional campaigns because attackers are not casting as wide a net as possible. Instead, the phisher is “laser-focusing” the campaign to collect specific credentials and data.

“Obviously quality data fetches a higher price in the underground,” Cohen said. It was likely these attacks were the work of a service vendor and not a lonely phisher, he said.

RSA has noticed that phishing toolkits are increasingly becoming more complex and sophisticated, featuring new capabilities such as real-time credential validations and built-in Web analytics tools to gauge the campaign’s success. Many of the kits take advantage of vulnerabilities in content management systems and third-party components. The new bouncer-list function was a perfect example of the trend, Kessem said.

The fact that a phishing page can display a 404 error page for some users “could present a detection challenge for the industry,” Kessem said.

According to RSA, the total number of phishing attacks launched in 2012 was 59% higher than the total calculated for 2011, up from 279,580 attacks to 445,004, costing the global economy over $1.5 billion dollars in fraud damages.

Written By

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...