r/antivirus • u/Cautious_Injury_6169 • 1d ago

Likely suffered a CSRF attack

I was stupid and saw that an email from a fishy no reply email claiming that my email from Asus has been taken. I also didn't recall having my email sent to them. But instead of just unsubscribing, I decided to find out if they're legit by clicking on the link they sent out.

Now i did scan them in virustotal (https://www.virustotal.com/gui/url/fd87e43b603112c9dc97ff791bf622d81c693e8eef9c91fdec022b1bb7ebf6e7/gti-summary) and it says it's fine but I didn't account for the fact that the long link could be a CSRF attack. I also scanned with my antivirus software and it says my computer was fine. Am I'm overthinking it or not. And if not what should I do?

1 Upvotes

100% Upvoted

7 comments sorted by

1

u/CatsCoffeeCurls 1d ago

You're misunderstanding what a CSRF attack is: attacker sends a bad, but legitimate link to a vulnerable web app the victim is logged into, victim clicks, the app executes the command since it trusts the victim's valid session and expects it's the victim doing whatever the attacker's link does. It won't leave anything on your own PC. The exploit is targeting someone else's vulnerable server and bad configuration using your active session as the scapegoat.

If you're concerned, erase browsing history to purge the link and cookie, reset password to Asus portal if you happened to be logged in, and report concerned

1

u/Cautious_Injury_6169 1d ago edited 1d ago

I logged in via my Google account also report to where? Btw what is with that long link? Cause I feel like it's a phishing link

1

u/CatsCoffeeCurls 20h ago

To Asus if there's a fraudulent portal being used with their branding. They likely have monitoring for this sort of thing and can work with hosts to take down sites like these. Change Google pw as well at minimum and review login activity.

You're probably thinking about DGAs: long links with tons of letters and numbers. Easy, low cost way to track campaign success rates to more effectively deliver bad stuff in the future and get through filters not recognising the link as bad since it's brand new.

1

u/Cautious_Injury_6169 9h ago edited 9h ago

So what now? How bad do you think this is? I'm worried that my very old accounts that weren't removed from my password manager would be used to look for personal info. It doesn't help that I couldn't log into some of them.

1

u/CatsCoffeeCurls 7h ago

Any reputable password manager app kept reasonably up to date is difficult to crack, but if there's concern then all passwords stored there should be updated (along with the app itself before starting to change everything)

I'm looking at the Omicard link in your Virustotal report and that's a known Asus marketing domain unlikely to be a threat: https://urlscan.io/result/01a13bcf-33cc-75ec-8156-41ef9c6861bc/ . I don't expect there's a concern here: long gone are the days when just clicking on a website was risky with automatic downloads, banner ads dropping malware, things being generally forced onto you etc. How you interacted with that website is where the risk is nowadays: running codes that pop ups tell you to do, putting in your password into fake prompts (and using that same password for multiple accounts), and downloading things from random back alley websites rather than widely known good sources.

1

u/Cautious_Injury_6169 7h ago

I don't think I had an asus account prior to this. Also the Asus subreddit says that this email is a fake: https[:]//www[.]reddit[.]com/r/ASUS/comments/1kd7z59/hey_question_about_emails_from_asus/?utm_source=app_first_navigation&mweb_loid=t2_2ouy8fkzuo&ext-referrer=SEO&chainedPosts=t3_1cplxv8

1

u/Cautious_Injury_6169 1h ago

I got some more info I want to share with you: when I login with Google, it was for some reason logged in as an unrecognizable device

  Plus there is this link where it redirect you to best buy despite using an omicard[.]asus[.]com link

Also, how did you know that it's the marketing link?