Detailed in a new report by Avanan, threat actors were recently observed geo-targeting websites through the platform Geo Targetly. This tactic is used to improve their phishing campaigns by sending customized, geo-specific content (typically by language and region) to different users in one phishing email. Geo Targetly is a legitimate platform that allows “advertisers to redirect users to pages and ads in their local markets” by determining the users’ geolocation. These threat actors are utilizing a variant of the “spray-and-pray” technique, which is when an actor sends out a large volume of phishing emails and few are successful. The unique aspect in this campaign is that the content is always relevant and localized across the large volume of targeted users, which is being referred to as “spraying without the praying.” The customization increases the likelihood of a user falling victim to the attack. In this campaign, a user will access a phishing link that will redirect them (using the legitimate platform) to a fraudulent login page that looks identical to the one it is impersonating and is based in the same region as the user. Avanan researchers detailed that this is the first instance they have identified Geo Targetly being used and the campaign’s method allows for a “fairly widespread attack.” Geo Targetly has confirmed that they are aware threat actors are capitalizing on their platform but argued that this method is not unusual. A Geo Targetly spokesperson claimed that the platform is a URL shortener similar to Bitly and smartURL, and that it is “common for hackers to hide the final destination URL behind a public URL-shortening domain.” The spokesperson did confirm, however, that the platform “manually check[s] through URLs created in [their] system to identify such bad actors.” CTIX will continue to monitor for different methodologies capitalizing on geo-targeting and provide details of new tactics as they become available.