Palo Alto Networks Enhances AURL with New HTTP Refresh Header-based Phishing Detector

[tuvu01]

 

What is HTTP Refresh Header-based Phishing, and Why is it Important?

HTTP Refresh Header-based phishing is a technique used by attackers to deliver malicious web pages. Unlike traditional phishing attacks that rely on HTML content, these attacks embed malicious links in the Refresh header of the server response. This method allows the malicious content to load into the user's browsers before any HTML is processed, all while preserving the appearance of the original legitimate-looking URLs. The lack of visible indicators makes these attacks highly effective and dangerous.

HTTP Refresh Header-based Phishing Example

From May 2024 to July 2024, our researchers observed large-scale phishing campaigns using this technique, with approximately 2,000 malicious URLs detected daily. These campaigns primarily targeted individuals in the global financial sector, well-known internet portals, and government domains. Attackers employed various tactics to evade detection, such as hosting original and landing URLs on legitimate or compromised domains, utilizing URL shortening, tracking, and campaign marketing services, and mimicking legitimate domains to redirect victims to official sites. Below is an example of attackers abusing HTTP refresh headers.

Figure 1. HTTP response header is shown in DevTools.

How does Palo Alto Networks Identify, Detect, and Block HTTP Refresh Header-based Phishing?

Palo Alto Networks Advanced URL Filtering (AURL) helps protect against these threats by identifying phishing URLs and extracting patterns from suspicious URLs to discover additional phishing websites. Our detectors can identify this type of threat by analyzing the HTTP headers. This ensures that even the most sophisticated phishing attempts are detected and blocked immediately. 

When Will this New Detection be Available?

The HTTP Refresh Header-based phishing detection capabilities have been in production since December 2024 and is now available.

What Action Is Needed to Benefit from HTTP Refresh Header-based Phishing Detection?

To benefit from the enhanced detection capabilities, organizations should enable the real-time category for URL filtering and follow the best practices outlined in this live community post. Additionally, decryption should be enabled to allow the firewall to  inspect the content.

Additional Information

For a comprehensive understanding of URL Filtering Category Best Practices, please refer to the provided documentation. Additionally, to learn more about HTTP Refresh Header-based Phishing visit our research team's blog to stay informed on the latest developments.