On the official website of the UK Department for Environment, Food and Rural Affairs (DEFRA), threat actors are employing open redirects to send users to the phony OnlyF ad*lt dating site.
Paid customers to the content subscription service OnlyF have access to private images, videos, and posts of ad*lt models, celebrities, and online personalities.
Threat actors have produced a number of fictitious OnlyFans ad*lt dating sites in an effort to entice users or obtain users’ personal information. OnlyFans is a well-known and popular website.
Threat actors used an open redirect that seemed to be a genuine UK government link as part of this malicious campaign to send users to the phony OnlyF dating website.
A lawful website URL that automatically directs a user away from the original website and onto another URL, typically an external website, is known as a redirect.
For instance, when a user clicks on a redirect like www.example.com/redirect/www.google.com, the user is automatically redirected to Google.
Open redirects are open to modification by anyone, enabling scammers and threat actors to set redirects from any trustworthy website to any other website.
Threat actors are now able to take advantage of open redirects and legal links in search results to send users to their own websites, display phishing forms, or spread malware.
Last week, Pen Test Partners analysts found a campaign that was abusing open forwarding on websites with DEFRA traffic conditions. They informed BleepingComputer of their discovery.
“On Tuesday afternoon, a colleague of mine named Adam Bromiley discovered an open redirect on the website of the UK Environment Agency. This query appeared in a Google search when he was seeking a SoC (hardware system on a chip) datasheet!” Pentest, as stated in The Partner report.
These redirects were presumably posted to websites that Google’s indexing bots later indexed in order to appear as search results for porn and ad*lt websites.