Researchers at WMC Global have found that a phishing kit is using images with inverted colors to avoid detection.
“PhishFeed analysts recently discovered a novel way some threat actors are tricking these scanning engines, and this bot avoidance mechanism in particular has been deployed on multiple Office 365 credential phishing websites,” the researchers write. “WMC Global threat analysts attribute the use of this method to a single threat actor selling the phishing kit to multiple users.”
Many security scanners and web crawlers are able to identify phishing pages by their appearance. If a site appears identical to the Office 365 login portal but doesn’t have an Office 365 domain, then the scanner concludes that it’s likely a phishing page.
“Because image recognition software is improving and becoming more accurate, this new technique aims to deceive scanning engines by inverting the colors of the image, causing the image hash to differ from the original,” the researchers write. “This technique can hinder the software’s ability to flag this image altogether. However, a victim visiting the website would likely recognize that the inverted picture is illegitimate and exit the website. As a result, the threat actor has stored the inverted image and, within the index.php code, has used a CSS method to revert the color of the image to its original state.”
The researchers conclude that this is a simple but effective way to deploy a convincing phishing page while avoiding detection.
“This approach results in the final website’s appearing legitimate to users who visit, while crawlers and scanning engines are highly unlikely to detect the image as being an inverted copy of the Office365 background,” the researchers write. “It is notable that the inverted image was discovered within a deployed Office 365 credential phishing kit. Our team reviewed other campaigns deployed by this threat actor, discovering that the individual was using the same inversion technique on the newer Office 365 background.”
New-school security awareness training can enable your employees to recognize phishing attacks that bypass your technical defenses.
WMC Global has the story.
Here's how it works:
