Phishing attacks grow in sophistication to evade defenses

guest · Jun 4, 2019

Phishing attacks grow in sophistication to evade defenses
June 4, 2019
https://betanews.com/2019/06/04/phishing-attacks-sophistication/

Despite businesses investing in next-gen technologies, phishing threats continue to become more sophisticated and effective according to a new report.
The study from intelligent phishing defense company Cofense shows how threat actors, armed with an ever-growing arsenal of tactics and techniques, continue to tweak their campaigns and enhance their capacity to deliver malware, ultimately getting more messages past perimeter controls to user inboxes.

Among the findings are that between October 2018 and March 2019, 31,429 total threats were reported by end users after delivery to the inbox, these included 23,195 via credential phishing and 2,681 via business email compromise (BEC).

Techniques used continue to evolve, Cofense is seeing activity such as the use of public, open source tools to evade detection and the leveraging of genuine Office 365 accounts to harvest credentials to increase the odds of reaching the inbox and delivering malware. The report outlines that sextortion and bomb scare extortion also pay off significantly when utilized by threat actors.
Click to expand...

Cofense: Report: Phishing Threat and Malware Review 2019
Infographic (PDF): https://cofense.com/wp-content/uploads/2019/05/PTM-Infographic.pdf

guest · Aug 19, 2021

4 Novel Techniques Help Phishing Emails Evade Detection
August 19, 2021
https://www.technadu.com/4-novel-techniques-help-phishing-emails-evade-detection/295604/

Microsoft warns about four new methods phishing actors follow in order to evade detection.

In most cases, the tricks involve adding obfuscation in the HTML code without affecting what the recipient sees.

Unfortunately, some of the new techniques cannot be blacklisted as the repercussions would be wide.

Click to expand...

For phishing actors, success boils down to delivery rates, as sending out millions of emails and managing to get only a few hundred through the filters is a waste of time, effort, and resources. As such, these crooks are constantly trying new techniques that could help them evade detection and keep those “red flags” of warning down. Microsoft’s Threat Intelligence team has spotted four new practices that are getting traction in the underground phishing community and is detailing them in a blog post.

The first trick is to use HTML tables to imitate the logos of the impersonated brand in phishing emails instead of using an image file for the purpose.
The next method which is currently on a steep rise in deployment is text padding with invisible characters. In most cases, the Unicode characters used for breaking up keywords in the email body and the subject line are Soft hyphen (U+00AD) and Word joiner (U+2060). The idea is to insert invisible characters between “keywords” that are typically in the blacklist of anti-spam solutions.
Click to expand...

Thirdly, there’s the technique of inserting hidden words with a font size of zero into the email body. This approach is also on the rise in deployment as it appears to be working well for the actors. The idea here is to add “garbage” HTML and CSS into the email body, right between words and phrases that could trigger security solutions.

And finally, there’s the technique of victim-specific URI, seeing a stable usage trend at the moment. This method involves the inclusion of custom URI parameters utilizing PHP to display information about the target.
Click to expand...

Microsoft: Trend-spotting email techniques: How modern phishing emails hide in plain sight

With the massive volume of emails sent each day, coupled with the many methods that attackers use to blend in, identifying the unusual and malicious is more challenging than ever.

An obscure Unicode character in a few emails is innocuous enough, but when a pattern of emails containing this obscure character accompanied by other HTML quirks, strange links, and phishing pages or malware is observed, it becomes an emerging attacker trend to investigate. We closely monitor these kinds of trends to gain insight into how best to protect customers.
Click to expand...

This blog shines a light on techniques that are prominently used in many recent email-based attacks. We’ve chosen to highlight these techniques based on their observed impact to organizations, their relevance to active email campaigns, and because they are intentionally designed to be difficult to detect. They hide text from users, masquerade as the logos of trusted companies, and evade detection by using common web practices that are usually benign:

Brand impersonation with procedurally-generated graphics

Text padding with invisible characters

Zero-point font obfuscation

Victim-specific URI

Click to expand...

guest · Oct 12, 2021

Phishing campaign uses math symbols to evade detection
October 12, 2021
https://www.bleepingcomputer.com/re...ampaign-uses-math-symbols-to-evade-detection/

Phishing actors are now using mathematical symbols on impersonated company logos to evade detection from anti-phishing systems.

One notable case spotted by analysts at INKY involves the spoofing of Verizon, a large U.S.-based telecommunication service provider.
In this case, the actors are using a square root symbol, a logical NOR operator, or the checkmark symbol itself, all helping to create a slight optical differentiation that could trick AI-based spam detectors.
Click to expand...

For many people who don't keep up with the latest logo changes though, these slightly altered logos look good enough, so the delivery success and user engagement rates have better chances of staying high.
You have fake voicemail
All three spoofing types masquerade as voicemail notifications containing an embedded ‘Play’ button, that when clicked, take the user to a phishing portal that was crafted to look like a Verizon website.
The actors bet on the carelessness of the target, as otherwise, the spoofed site looks pretty convincing. Also, Inky has found that this phishing campaign relied on recently-registered domains that were unreported.

The logo on the cloned site is the genuine one as the phishing actors stole most of the HTML and CSS elements from the real Verizon site.
Click to expand...

Log in or Sign up

Phishing attacks grow in sophistication to evade defenses

guest Guest

guest Guest

guest Guest

Log in or Sign up

Phishing attacks grow in sophistication to evade defenses

guest Guest

guest Guest

guest Guest

Useful Searches