New Phishing Tactic Uses Custom Web Fonts to Prevent Detection

guest · Jan 4, 2019

New Phishing Tactic Uses Custom Web Fonts to Prevent Detection
January 4, 2019
https://www.bleepingcomputer.com/ne...c-uses-custom-web-fonts-to-prevent-detection/

Threat actors in the phishing business have adopted a new technique to obfuscate the source code for the forged page by using a custom web font to implement a substitution cipher that looks like plaintext.
CSS code to do the job
The novelty factor here is that the page source did not have JavaScript functions to carry out the substitution, and this was done from the CSS code for the landing page.

Researchers were able to determine that the phishing page has a custom web font file that enables the web browser to render the ciphertext as plaintext.

"As the Web Open Font Format (WOFF) expects the font to be in a standard alphabetical order, replacing the expected letters "abcdefghi..." with the letters to be substituted, the intended text will be shown in the browser, but will not exist on the page," Proofpoint malware analysts explain in a blog post.
Click to expand...

Log in or Sign up

New Phishing Tactic Uses Custom Web Fonts to Prevent Detection

guest Guest

Log in or Sign up

New Phishing Tactic Uses Custom Web Fonts to Prevent Detection

guest Guest

Useful Searches