Indeed, Slack freely advertises Slack's robust file management and collaboration features, which include integration with third-party apps. In this case, the target is Slack's file storage domain,, which is typically used to host files uploaded by users within Slack itself.

And if the domain being used is recognized and trusted by your average cubicle dweller within businesses and organizations across the country or around the world, so much the better. To that end, they prefer sites and services that allow unknown users to create free accounts, though they are perfectly happy to use compromised pay accounts at online services if such accounts offer key benefits like, say, the ability to blast large volumes of malicious emails out to potential victims. The bad guys clearly, and for obvious reasons, prefer sites and services that can be used for free (whether legitimately or not). The attack method involved is a fairly familiar one in which the bad guys find a legitimate site or service that can be abused to host malicious files that can then be deployed to facilitate email-based phishing attacks. In late June of this year, however, customers starting reporting malicious emails using Slack in quite another way: as a host for malicious files used as part of phishing attacks. Indeed, we began receiving reports from customers using the Phish Alert Button (PAB) of malicious emails using this method back in late November of 2019.Įmails exploiting the domain have tended to land users at credentials phishing landing pages hosted on third-party web sites. One reported scheme, for example, involves using Slack's 'referral URL' domain,, to launder malicious links, allowing them to sail past multiple layers of security given that Slack domains will generally be trusted. Slack can be used for phishing users outside of Slack, though. those with with public channels devoted to crypto-currency-related topics and discussions. And, unsurprisingly, we already have reports of this method being used in Slack workspaces, esp.

Much of that ongoing discussion is focused on the use of publicly leaked Webhooks to inject malicious messages into Slack channels. Most of this attention has settled on various methods to phish users within Slack itself, and the concerns range from DMs to Slackbot reminders and public Slack channels or workspaces. Slack, the ubiquitous communication and collaboration platform, has been getting more and more attention over the past few months as a potential phishing platform and target for malicious actors.

Slack download multiple files