An unusual phishing technique has surfaced this week. Avanan, a Check Point Software company, released a blog Thursday morning detailing a new attack in which hackers hide malicious content inside a blank image within an HTML attachment in phishing emails claiming to be from DocuSign.
The campaign begins with an email appearing to originate from DocuSign, containing a link and an HTML attachment. The phishing email requests the review and signature of a document claiming to be “remittance advice.” If clicked, the “View Completed Document” button links to a clean, legitimate webpage, but the attachment, however, is not. If the document is opened, the blank image attack begins. The attachment includes an SVG image encoded with Base64 containing Javascript that redirects to the malicious link.
Hiding the malware within the empty image attachment hides the true intent of the message, and contains a legitimate link, allowing for the email to bypass link analysis and security scanners. Researchers advise caution around emails containing HTML, suggesting blocking all HTML attachments and treat them like executables.
Jeremy Fuchs, an Avanan Cybersecurity Researcher/Analyst, points out that this amounts to a new variation of existing attack methods. “Hackers can target practically anyone with this technique,” he says. “Like most attacks, the idea is to use it to get something from the end-user. Any user with access to credentials or money is a viable target. HTML attachments aren't new, nor are using Base64 trickery. What is new and unique is using an empty image with active content inside--a javascript image--which redirects to a malicious URL. It's essentially using a dangerous image, with active content inside that traditional services like VirusTotal don't detect.”
The threat actors evolve, and they’ll inevitably come up with novel approaches, like this one, that can catch out defenders until the protective tools catch up. An informed, alert user is the best and final line of defense. New-school security awareness training can give your organization an essential layer of security by enabling your employees to recognize social engineering attacks, even innovative ones like the blank-image phish hook.
Here's how it works:
