Threat actors are exploiting survey features on legitimate services to lure users into clicking on links to malicious sites.
Researchers say that free web-based survey services such as Yandex Surveys are being abused by attackers as a tool to lure targets and evade spam filters.
“They create a survey, embed links to fraudulent websites within the body, and blast out emails containing the survey link to their mailing lists,” said Anna Lazaricheva, a Kaspersky researcher.
“Standard anti-spam filters see URLs like yandex.com/poll/… as legitimate. Recipients often have the same reaction,” she wrote in a report posted last week.
The scam tactic has not so much ballooned in popularity so much as spontaneously erupted. Kaspersky found that between January and February the volume of survey scams went from 2,200 recorded messages to 32,000 with no signs of letting up.
In a typical scenario, the threat actor would use the Yandex Survey feature to create a new survey. From there, they would fill in the survey fields not with questions, but with links to their intended destination: malware and scam sites.
To help conceal the links, Lazaricheva says the attackers also use conventional tricks such as concealing the links with blocks of emojis and invisible text. (see image)
The result is a legitimate looking email with a URL that will not tip off either the intended target or their email filter. The most popular themes for the scams entice recipients with the promise of a “windfall in digital currency” or link to a “sketchy” dating site, according to the report.
The deception technique is the malicious sender masks the Yandex Survey so it doesn’t appear to be a survey. The messages received appear a commercial offer sent from the trusted Yandex domain.
“Yandex Surveys allows users to swap out a simple question for a text block, which can include descriptions, images, or videos. This is exactly where scammers embed their pitch and the link to their phishing site,” Lazaricheva noted.
“They use the built-in “Upload media” feature to add official-looking logos and other embellishments that sell the illusion.”
By frontloading the survey email with the malicious sender’s intended text, image, and link the actual survey trigger is either covered or pushed far down the body of the message where it will likely not be seen.
Yandex, Russia-based search engine and services firm, commands approximately 2 percent of the global search engine market behind Google (90 percent) and Bing (4.5 percent) and ahead of Yahoo (1.3 percent) and DuckDuckGo (1 percent), according to Statcounter.
The security firm is advising users and administrators to be wary of unsolicited surveys, even if they look legitimate, avoid clicking on suspicious links, and when in doubt scroll down the message to spot tricks such as hidden emojis or text blocks.
Shaun Nichols is an IT news journalist. He has spent nearly 20 years covering the industry with a specialty in the cybersecurity field.
