Fraudsters Use HTML Legos to Evade Detection in Phishing Attack
Criminals stitch pieces of HTML together and hide them in JavaScript files, researchers report.
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Researchers with Trustwave SpiderLabs are warning of a phishing campaign that employs what it calls "HTML Lego" to deliver a fake login page.
The phishing campaign is aimed at Microsoft 365 users and designed to mimic a Microsoft login interface. Trustwave says the emails contain nothing in the email body but have an attachment that appears to be an Excel file offering information about an investment. This attachment is actually an HTML document with two sections of URL encoded text. Fraudsters pieced together different pieces of HTML hidden in JavaScript files to generate the fake login page.
Researchers say the first block of URL encoded text is the first part of the HTML code, where the beginning HTML tag is located. The second block of URL encoded text contains an HTML JavaScript code that validates victims' email and password input.
“This phishing campaign design was a little more tricky than usual,” researchers say in a summary of the findings. “By improvising an HTML email attachment that incorporates remote JavaScript code located on a free JavaScript hosting site, and ensuring the code is encoded uniquely, the attackers seek to fly under the radar to avoid detection.”
A detailed analysis of the campaign can be found here.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024