There is a really interesting blog post by @ossij called “Hacking the a tag in 100 characters“.
I suspect the nefarious utility of this is going to be pretty extensive. We often tell our constituents in security awareness training to look at the address of a link before clicking on it. This strategy certainly has the ability to undermine that guidance, particularly if this JavaScript works in HTML emails. And I expect that it will work in HTML emails. One more reason that viewing email in plain text is a good idea.
I can envision some new crafty targeted watering hole attacks with this method. Rather than including a noisy iframe that gets presented to everyone, links on the page are redirected to a malicious site after clicking, but only for the intended victim – the page looks and works normally for everyone else.
Stay safe,
Jerry
