Kaspersky Warns of a New Phishing Technique

Traditional phishing attacks often rely on malicious links or obvious redirection techniques, which are typically flagged and blocked by modern security systems.

However, attackers are now leveraging Bubble’s no-code environment to generate intermediary web applications, which are hosted on Bubble’s legitimate infrastructure and trusted domains such as *.bubble.io, thereby improving their credibility and helping them bypass security filters. These applications function as disguised redirectors, silently forwarding victims to malicious credential-harvesting websites.

Kaspersky has discovered a new phishing tactic used to evade traditional security controls that exploits Bubble, a platform that allows users to build web and mobile applications through a visual interface without writing code. Attackers are increasingly adopting innovative tools designed for legitimate software development and repurposing them to boost phishing campaigns.

This technique is likely to be integrated into broader phishing-as-a-service (PhaaS) platforms and phishing kits. These kits enable a wide range of malicious capabilities with ready-made tools, including real-time interception of session cookies, driving phishing campaigns through legitimate services such as Google Tasks and Google Forms, and carrying out adversary-in-the-middle (AiTM) attacks that can bypass multi-factor authentication. They also support the generation of phishing emails using AI, implement geo-filtering and anti-detection mechanisms to evade security crawlers, and are often hosted on reputable cloud services like AWS to avoid blacklisting.

“The use of legitimate platforms like Bubble introduces a new level of trust abuse, making it harder for both users and automated systems to distinguish between safe and malicious content. This significantly increases the likelihood of credential theft, unauthorised access and potential data breaches,” comments Roman Dedenok, Anti-Spam Expert at Kaspersky.