JavaScript Obfuscation Moves to Phishing Emails

guest · Oct 30, 2020

JavaScript Obfuscation Moves to Phishing Emails
Attackers are hiding malicious payloads in phishing emails
October 30, 2020
https://www.darkreading.com/threat-...ation-moves-to-phishing-emails/d/d-id/1339332

JavaScript, the ubiquitous scripting language used across Web applications worldwide, is becoming a key ingredient in phishing campaigns looking to plant malicious code on victims' computers, new research shows.

In the first of a series of blog posts on his research, he said "content escaping," while not a sophisticated obfuscation technique, is effective at hiding - or obfuscating - the malicious content of a message. It is also far more commonly used on malicious websites than in phishing or scam email messages. It's the technique's growing use in email that caught Katz's attention.

JavaScript has been used in fairly simple obfuscation techniques, but the obfuscation is becoming more sophisticated, he found.
Click to expand...

Katz then took a closer look a specific campaigns using the JavaScript obfuscation techniques. He notes In the second blog post that single malicious email messages are now carrying JavaScript code that uses multiple obfuscation and re-direction techniques, including URL cloaking, content escaping, and polymorphic functions at the same time.

He told Dark Reading he believes JavaScript obfuscation will increase in email phishing attacks.

"There is a movement from using solely emails as a way to propagate phishing scams into social networks and messaging and social messaging platforms to deliver a lot of those scams," he says.
"When you try to distribute attacks through of social media, then you are actually using the power of that platform to do a very rapid kind of distribution that is dependent on the trustworthiness of the people that are distributing them."
Click to expand...

Akamai:
Catch Me if You Can - JavaScript Obfuscation

Due to its client-side nature, JavaScript gives those using it the ability to evade detection, by creating obfuscated code that doesn't reveal its true nature until it is executed by the victim's machine
Click to expand...

The Tale of Double JavaScript Obfuscated Scam

In this blog, we'll take a deep dive into a different type of evasive technique called JavaScript obfuscation, which is being used in many types of scams such as phishing and Magecart attacks, and follow a unique example of double obfuscation and encryption recently observed in an active phishing scam.
Click to expand...

Phishing JavaScript Obfuscation Techniques Soars

Today, using Akamai's visibility into phishing attacks - including an analysis of more than 10,000 URLs using JavaScript obfuscation techniques over 10 months - we'll follow the observed trends of websites using JavaScript obfuscation techniques in the wild in order to evade detection and fly under the radar.
Click to expand...

Log in or Sign up

JavaScript Obfuscation Moves to Phishing Emails

guest Guest

Log in or Sign up

JavaScript Obfuscation Moves to Phishing Emails

guest Guest

Useful Searches