Image Inversion as a Phishing Technique

Image Inversion Phishing TechniqueResearchers at WMC Global have found that a phishing kit is using images with inverted colors to avoid detection.

“PhishFeed analysts recently discovered a novel way some threat actors are tricking these scanning engines, and this bot avoidance mechanism in particular has been deployed on multiple Office 365 credential phishing websites,” the researchers write. “WMC Global threat analysts attribute the use of this method to a single threat actor selling the phishing kit to multiple users.”

Many security scanners and web crawlers are able to identify phishing pages by their appearance. If a site appears identical to the Office 365 login portal but doesn’t have an Office 365 domain, then the scanner concludes that it’s likely a phishing page.

“Because image recognition software is improving and becoming more accurate, this new technique aims to deceive scanning engines by inverting the colors of the image, causing the image hash to differ from the original,” the researchers write. “This technique can hinder the software’s ability to flag this image altogether. However, a victim visiting the website would likely recognize that the inverted picture is illegitimate and exit the website. As a result, the threat actor has stored the inverted image and, within the index.php code, has used a CSS method to revert the color of the image to its original state.”

The researchers conclude that this is a simple but effective way to deploy a convincing phishing page while avoiding detection.

“This approach results in the final website’s appearing legitimate to users who visit, while crawlers and scanning engines are highly unlikely to detect the image as being an inverted copy of the Office365 background,” the researchers write. “It is notable that the inverted image was discovered within a deployed Office 365 credential phishing kit. Our team reviewed other campaigns deployed by this threat actor, discovering that the individual was using the same inversion technique on the newer Office 365 background.”

New-school security awareness training can enable your employees to recognize phishing attacks that bypass your technical defenses.

WMC Global has the story.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews