Attackers are hiding malicious payloads in phishing emails via a technique traditionally used to hide malicious code planted on websites.
In the first of a series of blog posts on his research, he said “content escaping,” while not a sophisticated obfuscation technique, is effective at hiding – or obfuscating – the malicious content of a message. It is also far more commonly used on malicious websites than in phishing or scam email messages. It’s the technique’s growing use in email that caught Katz’s attention.
“There is a movement from using solely emails as a way to propagate phishing scams into social networks and messaging and social messaging platforms to deliver a lot of those scams,” he says. “When you try to distribute attacks through of social media, then you are actually using the power of that platform to do a very rapid kind of distribution that is dependent on the trustworthiness of the people that are distributing them.”
Because the techniques are being so successful, Katz says that they’re not limited to a single criminal organization or geographic area: they’re being used worldwide by a wide variety of threat actors. And because they can come from so many sources, and hide in so many ways, Katz says that basic user education may still be one of the most powerful tools to use against them.
It starts, he says, with reminding users that an email message that seems too good to be true probably is. And if the URL seems unusual, or appears from an unusual location in a message or on a Web page, that should be a red flag.
“Stop at that point, think twice and try to figure out if you need to give any personal information.” If it’s suspicious enough to make you think, he says, then it’s almost certainly suspicious enough to make you stop.
Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio