SaaSquatting
SaaSquatting (Software-as-a-Service Squatting) is a social engineering and brand impersonation technique in which threat actors register a legitimate organization's brand name as a subdomain or an account name on a popular SaaS platform. By using the trusted domain of a major service provider, attackers can create deceptive environments that appear authentic to employees, customers, and automated security filters.
What is SaaSquatting?
SaaSquatting is the act of preemptively registering a specific brand or company name on a third-party SaaS platform to deceive users or gain leverage over the brand. Unlike traditional cybersquatting, which involves registering top-level domains like "company-login.com," SaaSquatting takes place within the infrastructure of trusted providers such as Slack, GitHub, AWS, Salesforce, or Trello.
For example, if a company named "Global Finance" has not claimed its name on a specific platform, an attacker might register globalfinance.slack.com or globalfinance-backups.s3.amazonaws.com. Because the root domain (e.g., slack.com or amazonaws.com) is trusted, users are more likely to trust the malicious subdomain.
How SaaSquatting Works
The mechanics of a SaaSquatting attack rely on the inherent trust users place in established service providers. The process generally follows these steps:
Reconnaissance: Attackers identify organizations that have not claimed their names across various SaaS platforms.
Registration: The attacker registers the brand name as a subdomain or workspace name.
Deception Staging: The attacker sets up the environment to mimic the target brand, often using stolen logos, corporate colors, and professional language.
Exploitation: The "squatted" account is used to launch phishing campaigns, harvest credentials, host malicious files, or demand a "ransom" from the brand in exchange for handing over the account.
Common Types of SaaSquatting
SaaSquatting can manifest in several ways depending on the platform being used:
Subdomain Squatting: Registering a brand name on platforms that assign unique subdomains to users, such as brand.zoom.us or brand.zendesk.com.
Cloud Storage Squatting: Creating storage buckets with brand-related names (e.g., brand-internal-data) on services like AWS, Azure, or Google Cloud.
Collaboration Workspace Squatting: Creating unauthorized Slack channels, Microsoft Teams groups, or Trello boards that appear to be official corporate environments.
Version Control Squatting: Registering a company's name on GitHub or GitLab to host malicious code that looks like it belongs to the official organization.
Why SaaSquatting is a Major Security Risk
SaaSquatting is particularly dangerous because it bypasses many traditional security defenses. The primary risks include:
Bypassing Reputation Filters: Most security tools trust traffic coming from major SaaS providers. A malicious link to a "squatted" AWS bucket is less likely to be flagged than a link to an unknown, newly registered domain.
High-Fidelity Phishing: Employees are trained to verify a website's URL. When they see a legitimate root domain like atlassian.net, they may feel safe entering their credentials, even if the subdomain is controlled by an attacker.
Credential Harvesting: Attackers can create fake login portals within these squatted environments to capture Single Sign-On (SSO) or corporate credentials.
Data Exfiltration and Hosting: Malicious actors can use squatted cloud buckets to host malware or receive stolen data, making the traffic appear to be legitimate cloud usage.
Defense and Mitigation Strategies
Organizations can protect themselves from SaaSquatting by taking a proactive approach to their digital presence:
Defensive Registration: Proactively register your brand name on all major SaaS platforms, even if you do not plan to use them immediately.
External Attack Surface Monitoring: Use tools to continuously scan for the registration of your brand name as a subdomain or account name on third-party services.
Brand Protection Services: Use services that specialize in identifying and taking down impersonation attempts across the web and social media.
Employee Awareness Training: Educate staff that a trusted root domain does not always guarantee a trusted environment, especially when dealing with subdomains.
Official Communication Channels: Clearly define and communicate which SaaS platforms and subdomains are official company resources.
Frequently Asked Questions (FAQ)
How is SaaSquatting different from Typosquatting?
Typosquatting involves registering a domain that is a common misspelling of a brand (e.g., gogle.com). SaaSquatting involves registering the correct brand name but as a subdomain on a different, trusted service provider (e.g., google.slack.com).
Is SaaSquatting legal?
In many cases, registering a trademarked name with the intent to deceive or extort is a violation of trademark laws and platform Terms of Service. Most major SaaS providers have policies in place to help legitimate brands reclaim squatted accounts.
Can attackers use SaaSquatting for ransomware?
Yes. Attackers may register a critical brand name and demand payment to transfer the account to the legitimate owner. Additionally, they can use squatted accounts to launch phishing emails that eventually lead to a ransomware infection.
Why do companies leave themselves open to SaaSquatting?
Many organizations focus only on their primary web domain and fail to realize that their brand identity can be "claimed" by anyone across thousands of SaaS platforms and cloud services.
How ThreatNG Identifies and Neutralizes SaaSquatting Risks
SaaSquatting (SaaS-based brand impersonation) has become a primary vector for sophisticated phishing and data exfiltration. ThreatNG addresses this challenge by providing an unauthenticated, outside-in view of the digital attack surface and identifying unauthorized brand presence across third-party platforms before it can be used in a breach.
Recursive External Discovery of Squatted Assets
ThreatNG uses a patented, agentless discovery engine to map an organization’s digital footprint exactly as an adversary would. This process does not require internal connectors or prior knowledge of existing assets, making it uniquely effective at finding "Shadow SaaS" and squatted accounts.
Brand Permutation Monitoring: The engine performs continuous passive reconnaissance for brand variations, typosquats, and keyword matches (such as "login" or "pay") across the global web and Web3 environments.
Automatic Asset Mapping: By starting with a primary domain, ThreatNG recursively finds associated subdomains and third-party SaaS workspaces that use the company’s name without authorization.
Shadow IT Visibility: It uncovers "rogue" cloud instances or collaboration workspaces created by employees or malicious actors that exist entirely outside the visibility of internal IT inventory tools.
Detailed External Assessments and Security Ratings
Once a potential SaaSquatting instance is discovered, ThreatNG performs deep-level assessments to determine the actual risk it poses to the organization. These findings are translated into objective A-F security ratings.
BEC and Phishing Susceptibility
This assessment evaluates how easily an attacker can use a squatted domain to impersonate corporate leadership or financial departments.
Detailed Example: ThreatNG identifies a squatted domain on a popular site builder that uses the company's official logo and lacks DMARC protection. The platform flags this as a "High" susceptibility to Business Email Compromise (BEC), as an attacker could send emails from this seemingly trusted domain to deceive employees into changing wire transfer details.
Subdomain Takeover Susceptibility
Attackers often use SaaSquatting in conjunction with "dangling DNS" to hijack legitimate corporate subdomains.
Detailed Example: The engine finds a DNS CNAME record for "support.company.com" pointing to a Zendesk instance that has been deleted. ThreatNG validates that this instance is unclaimed, alerting the team that a SaaSquatting actor could register that exact Zendesk name and immediately begin interacting with customers as the legitimate support team.
Proactive Defense Through Investigation Modules
ThreatNG includes specialized investigation modules that provide the technical evidence needed to confirm and dismantle SaaSquatting operations.
SaaSqwatch (Cloud and SaaS Exposure): This module is designed to identify externally exposed SaaS applications and cloud buckets.
Example: It can identify an unauthorized AWS S3 bucket named "company-client-backups." By analyzing the bucket's metadata, ThreatNG confirms it is publicly readable, preventing a massive data leak before the "squatter" can monetize the information.
Social Media Discovery: This module monitors for the creation of unauthorized corporate profiles and the "Human Attack Surface."
Example: ThreatNG flags a new, unauthorized LinkedIn "Company Page" that is actively recruiting employees. This allows the security team to initiate a takedown request before the squatter can use the page to harvest employee credentials or spread malware.
Technology Stack Investigation: This module identifies the specific technologies being used on squatted pages, allowing defenders to understand the capabilities of the attacker’s infrastructure.
Strategic Intelligence Repositories
ThreatNG enriches its technical discovery with real-world threat context via its DarCache repositories.
DarCache Dark Web: This repository allows security teams to search for their brand name or squatted domains within dark web forums. This helps determine if a squatted account is already being discussed as a target for an upcoming campaign.
DarCache Ransomware: By tracking the tactics of over 100 ransomware groups, ThreatNG can identify if a squatted cloud bucket is being used as a "staging area" for exfiltrated data, a common sign of an impending ransomware demand.
Reporting, Continuous Monitoring, and the DarChain
ThreatNG transforms raw data into actionable intelligence through specialized reporting and exploit path mapping.
Legal-Grade Attribution: ThreatNG provides the mathematical proof and evidentiary documentation needed to act as a Score Auditor. This allows organizations to dispute inaccurate security scores from third-party agencies that may have mistakenly attributed a squatted, malicious asset to the legitimate company.
DarChain Exploit Paths: Findings are woven into a visual narrative that shows the "Attack Choke Points."
Example: A DarChain report might show how a squatted GitHub repository (Step 1) contains a leaked API key (Step 2), which provides access to a production database (Step 3). This helps leadership understand the business impact of a seemingly minor "squatted" account.
Continuous Monitoring: ThreatNG aligns with Continuous Threat Exposure Management (CTEM) by constantly rescanning the web. This ensures that the moment a new SaaSquatting domain is registered, it is identified and reported.
Cooperation with Complementary Solutions
ThreatNG serves as a foundational intelligence layer that enhances the effectiveness of other security investments through proactive collaboration.
Cooperation with SIEM and XDR: By feeding confirmed SaaSquatting domains into SIEM and XDR platforms, security teams can proactively block traffic to these malicious sites at the firewall and endpoint levels. This cooperation ensures that even if an employee clicks a phishing link, the connection is terminated before any data is exchanged.
Cooperation with Breach and Attack Simulation (BAS): ThreatNG provides the "real-world" squatted domains it finds to BAS tools. This cooperation allows the organization to run simulations to test whether its existing email filters and employee training are effective against the specific, active threats currently targeting its brand.
Cooperation with Cyber Risk Quantification (CRQ): ThreatNG provides the "telematics"—actual facts about brand impersonation and exposed cloud buckets—that CRQ platforms use to calculate financial risk. This cooperation moves risk modeling away from industry averages and toward a personalized, defensible financial view of the organization's exposure.
Common Questions About SaaSquatting Defense
How does ThreatNG find squatted accounts on platforms I don't use?
ThreatNG does not rely on your internal list of platforms. It recursively scans the "Global Web" and major SaaS providers. Looking for your brand identity from the "outside-in" helps identify where your name is used, regardless of whether you have an official presence on that platform.
What is a Positive Security Indicator in brand protection?
ThreatNG documents where you have successfully claimed your brand and implemented security controls like Multi-Factor Authentication (MFA) or Web Application Firewalls (WAFs). This helps prove to the board that your proactive defensive registrations are effectively reducing the organization's attack surface.
Can ThreatNG help with taking down squatted sites?
While ThreatNG focuses on discovery and high-fidelity assessment, it provides the "Legal-Grade Attribution" and technical evidence required for rapid takedowns. This evidentiary ammunition is used to prove to SaaS providers that a specific account is an unauthorized impersonation.
Why is an "unauthenticated" approach better for finding SaaSquatting?
Internal tools can only see what is connected to your network. Because SaaSquatting occurs on third-party infrastructure you don't own, an unauthenticated, "outside-in" engine is the only way to see these assets as an attacker or a victim would.
