Following the kick-off of the UEFA Euro 2024 in Germany, Egress’ Threat Intelligence team has observed a massive spike in Euros-related phishing attacks, recording 7,000 unique campaigns with over 24,000 individual attacks since June 17th, 2024.

These attacks are highly sophisticated, with many attackers choosing to impersonate businesses associated with the tournament rather than impersonating UEFA directly. Consequently, a significant portion of these attacks target transportation, accommodation, and gambling businesses linked to the Euros.

Booking.com was the most impersonated brand, closely followed by German airline, Lufthansa, and Uber.a Other impersonated brands include Trainline, Eurostar, Tripadvisor, Hotels.com and Marriott.com.

Attackers are using lookalike email domains, such as Eurostɑr[.]com, utilising typosquatting techniques to alter characters in the domain to appear valid and pass authentication checks. The Egress Threat Intelligence team has also noticed spoofed email domains, which are identical to legitimate ones but cannot be registered and therefore fail common authentication checks.

All the attacks are link-based credential harvesting schemes, often using obfuscation techniques such as URL shorteners to mask the destination and bypass link-scanning solutions. Most of the malicious URLs are domains hosted on Cloudflare, one of the biggest networks on the internet.

What the attacks look like: The initial phishing email

In the first example analysed below, the attacker has sent a phishing email impersonating Booking.com, the official accommodation partner of the UEFA EUROs 2024. They have used a highly stylised template mimicking Booking.com’s branding so closely that Egress’ Threat Intelligence team suspects they have taken a screenshot of Booking.com’s website and added the EURO-related elements.

The attacker has also sent the phishing email from a ‘lookalike’ email domain, using Booking.com’s well-known slogan (“booking-dot-yeah”) to make the attack more convincing. As this is a lookalike rather than a direct spoof, the email is likely to pass traditional authentication checks on delivery.

In this example, the entire email is made up of one image which limits linguistic analysis to the subject line and display name – both of which do not appear overly suspicious. The payload is the shortened link attached to the image, which then directs the recipient to the malicious Cloudflare hosted site.

Screenshot of phishing attack impersonating Booking.com, with Egress Defend anti-phishing banners applied

What the attacks look like: The ‘Lookalike’ phishing websites

The second step of this multi-stage attack leads recipients to a malicious site hosted on Cloudflare, hoping they will input their credentials or financial details. With over 7,000 unique campaigns, this step has varied significantly, with some malicious sites impersonating brands like Booking.com, well-known gambling companies, and other accommodation and travel pages.

In the first example below, however, the link directs the recipient to a convincing impersonation of a Microsoft login page. Although this seems unrelated to the initial phishing emails, our Threat Intelligence team suspects the hope is that, if the email is opened on a business device, the recipient will think this is a re-authentication process and input their credentials to proceed.

As a result, the attacker can use the credentials to compromise the individual’s business email and potentially other accounts if the password is reused. They may then move laterally across that individual’s organisation using this account as a foothold.

Screenshot of a malicious website used for credential harvesting, impersonating a Microsoft log in page.

Using legitimate tools for illicit gains

In these campaigns, attackers have employed a couple of legitimate business tools to enhance the credibility of their attacks.

The first is URL-shortening websites such as bit.ly, usually used to condense long links for business purposes. In this circumstance attackers have used them to obfuscate malicious links, making them difficult for link scanning technologies to read. Less advanced security solutions may accept the shortened link as safe, overlooking its malicious intent. More advanced tools, however, can recognise the presence of these redirects as suspicious activity.

The second legitimate tool is Cloudflare, one of the biggest and well-known networks on the internet. Egress’ Threat Intelligence team suspect attackers have used this platform to host malicious URLs for several reasons:

• It is free, accessible, and easy to use.
• It has a good reputation, so any associated links will appear less suspicious. This also means security teams can’t block all domains that come from Cloudflare as many may be used for legitimate purposes.
• There is a polymorphic element to Cloudflare – it can quickly randomise new domains, so if one domain gets put on a blocklist, Cloudflare can quickly produce another.
• Cloudflare incorporates captchas into its service to prevent automated bots from clicking on links. These captchas effectively block link scanning technologies, rendering them ineffective. Since many secure email gateway (SEG) solutions rely solely on link scanning, they may fail to flag such links as malicious.

Quantity over quality – attacks en masse

These attacks, though not the most sophisticated in design, capitalise on sheer volume to increase their chances of success. By inundating inboxes, attackers aim to exploit even a small percentage of recipients who may engage whilst creating an administrative burden for security teams who must remediate each attack.

The strategy hinges on the ripple effect of a single successful breach: once an individual falls victim and their credentials are compromised, attackers can move laterally within an organisation.

Social engineering techniques

The campaigns also employ social engineering tactics to exploit the allure of a major event like the UEFA EUROs 2024. By crafting convincing narratives such as enticing offers related to travel accommodations, budget deals, or exclusive ticket competitions, attackers manipulate recipients’ urgency and FOMO.

They capitalise on the excitement and heightened interest around football events, appealing to the stereotypical mentality of those eager to secure the best deals or participate in gambling activities tied to game outcomes. These tactics not only exploit the event’s popularity but also human emotions and behaviours to maximise their impact and success rates.

Identifying advanced phishing threats

The surge in phishing attacks linked to the UEFA EUROs 2024 serves as a stark reminder of the pervasive threat posed by social engineering tactics in the digital age. By exploiting the collective enthusiasm and trust surrounding a high-profile event and reputable brands, cybercriminals demonstrate a sophisticated understanding of human psychology and behaviour, even if the attacks themselves aren’t so advanced.

Recommended reading

• Scots Researchers Help Build AI Model for Identifying Pre-eclampsia Risks
• Can AI Help Radiologists With Breast Cancer Screening?
• Persistent Data Breaches Are Failing People With HIV

As attackers attempt to capitalise on the EUROs through budgets, competitions and deals, the adage “if it’s too good to be true, it probably is” rings truer than ever. Staying informed, verifying sources, and exercising caution can greatly mitigate the risk of falling victim to such attacks.

Ultimately, identification and prevention of this type of advanced threat requires a combination of tailored coaching and an intelligent anti-phishing technology that does not rely on any singular detection mechanism like link scanning alone. Egress Defend takes a holistic approach to detection, using AI and a zero-trust approach to detect and neutralise emerging threats like impersonation and zero-day attacks.