Metabase SQL Injection Vulnerability in Real-World Phishing Campaigns

In the digital threat landscape, the Metabase SQL Injection vulnerability, identified as CVE-2026-72898, has emerged as a critical vector in phishing campaigns. Recent observations point to threat actors exploiting this flaw to gain unauthorized access and manipulate databases, thereby amplifying the threat surface of the targeted organizations. This article dissects these campaigns, focusing on how they are architected to achieve maximum impact.

Campaign or TTP Overview

In the first quarter of 2023, security researchers at Horizon3.ai identified a persistent threat campaign leveraging the CVE-2026-72898 vulnerability within Metabase platforms. This campaign primarily targeted organizations within the financial sector, crucially impacting data integrity and confidentiality. Preliminary analysis suggests the campaign originated from an advanced persistent threat group known for targeting high-value data troves.

By exploiting this SQL Injection vulnerability, attackers were able to inject malicious SQL queries, giving them control over the database’s operations. These maneuvers enabled illicit extraction of sensitive data, including personally identifiable information (PII) and proprietary corporate details. The campaign leveraged timing techniques to evade detection, slowly accumulating a significant volume of data over several weeks.

Documented attacks during this campaign were notably sophisticated, with operations mimicking legitimate maintenance tasks. Reports suggest that targets were preselected based on the maturity of their Metabase implementations, choosing victims who likely possessed extensive datasets and operational importance.

How It Was Built

The infrastructure setup for this campaign employed a combination of compromised servers for staging and command-and-control (C2) operations. Attackers tactically selected domain names that closely resembled legitimate IT service providers, utilizing subdomains like support.exampletechs.com to enhance credibility.

Attackers used spear-phishing emails with subject lines engineered for urgency and familiarity: “Critical System Update Required – Action Needed by [Date]”. These emails typically originated from spoofed sender addresses such as update@metabasesupport.com, with headers designed to bypass standard email filters.

The payload delivered via the phishing emails integrated a link directing victims to a counterfeit Metabase login page. The page closely mimicked legitimate interfaces, facilitated by embedded scripts that executed the SQL injection payload once the user attempted to authenticate.


POST /metabase/login HTTP/1.1

Host: login-truthfulservices.com

Content-Type: application/x-www-form-urlencoded

Content-Length: 105



username=test@test.com&password=P@ssw0rd!&query=' OR '1'='1' -- &submit=Login

Why It Worked

The campaign’s success can be attributed to several strategic decisions by the attackers:

Compromised Identity Mimetics: Utilizing domains closely aligned with existing tech service companies reduced recipient suspicion and enhanced email deliverability.
Targeted Contextual Framing: The framing of emails as urgent system updates engaged immediate attention, leveraging the inherent trust in IT communications to drive action from well-meaning users.
Realistic Interface Duplication: Precise replication of Metabase login pages reduced the likelihood of users questioning legitimacy, even diluting perceptual defenses among trained personnel.

Operator Takeaways

From a red team’s perspective, this campaign offers several adaptable techniques:

Focus on authenticity in mimetic design, ensuring that email and landing page visual queues seamlessly mirror legitimate sources.
Integrate timing-focused payloads, allowing for staged and stealthier operational gain, mimicking real-world IT constraints and schedules.
Exploit manual systems penetration, as demonstrated, by honing in on vulnerabilities within specific software versions popular among target pools.

Good / Better / Best

Good: Implement basic domain spoofing to increase email trustability.
Better: Enhance email body content with relevant, specific IT service details to increase perceived legitimacy.
Best: Utilize highly sophisticated web phishing frameworks that can dynamically mimic recent updates on login interfaces for major platforms, ensuring that replication remains ahead of user familiarity trends.

References

Horizon3.ai CVE-2026-72898 Vulnerability Research

NIST NVD: CVE-2026-72898 Details