URLs have always been a great hiding place for threat actors
Summary: Cisco Talos notes that ICANN released .zip and .mov as top-level domains on the same day, letting attackers register real URLs that look like filenames such as "WeddingVideo.mov" and also opening the door to accidental information leaks. Talos also describes older URL tricks, including typo-squatted domains like tvitter[.]com and the "@" operator, where https://google[.]com@bing[.]com actually sends the user to bing.com.
What you should know: A user who reads "WeddingVideo.mov" as an attachment from family will click it, and the same confusion applies to any employee judging a link by its ending rather than its destination.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026