The following link was received in a suspected phishing attack email. Unfortunately, the recipient clicked on the link in their outlook client:
<tr> <td class="m_-[string-of-19-numbers]m_-[string-of-19-numbers]gmail-x_gmail-summaryIfMobile" style="text-decoration:none;padding:18.1px 13px;background-color:rgb(212,238,246);font-family:Trebuchet MS;font-size:11px;font-weight:normal;font-style:normal;text-align:left;color:rgb(80,80,80)"> This summary of your queued emails for the last 7 days. Please use the retrieve queued emails to release emails your email account <a rel="noopener noreferrer" href="http://#%23email%23%23" target="_blank">email@example.com</a> inbox.</td> </tr>
The user reported that it opened a new window in their web browser (firefox), which is expected based on the
target. I'm trying to determine the possible scope of the breach. Ordinarily I would assume
http://#%23email%23%23 is a broken link, since there's no actual resource identifier before the fragment identifier. However, given the phishing and the client-side nature of fragment identifier interpretation, I'm left wondering:
What was the attacker trying to do with this link? How can fragment identifiers be abused? Are there other areas of this email that I should look to for clues?