Microsoft has released new details on a phishing campaign which employed evolving tactics including the use of Morse code to evade detection.
During the year-long investigation carried out by researchers from Microsoft Security Intelligence, the cybercriminals behind the campaign changed obfuscation and encryption mechanisms every 37 days on average to avoid having their operation detected.
The campaign itself used an invoice-themed XLS.HTML attachment divided into several segments including the JavaScript files used to steal passwords which are then encoded using various mechanisms. Over the course of Microsoft's investigation, the attackers went from using plaintext HTML code to using multiple encoding techniques including some older and unusual encryption methods like Morse code to hide these attack segments according to a new blog post.
- We've assembled a list of the best malware removal software
- These are the best antivirus software solutions on the market
- Also check out our roundup of the best ransomware protection
To avoid detection further, some of the code segments used in the campaign were not even present in the attachment itself and instead resided in a number of open directories.
Fake payment notices
This XLS.HTML phishing campaign uses social engineering to create emails that mimic the look of financial-related business transactions in the form of fake payment notices.
The campaign's primary goal is credential harvesting and while it originally harvested usernames and passwords, in its more recent iteration it has also started collecting other information such as IP addresses and locations which the cybercriminals behind it use as the initial entry point for later infiltration attempts.
Although XLS is used in the attachment file to prompt users to expect an Excel file, when the attachment is opened it launches a browser window instead that takes potential victims to a fake Microsoft Office 365 login page. A dialog on the page prompts users to login again as their access to the Excel document has supposedly timed out. However, if a user does enter their password, they will then receive a fake note saying that the submitted password is incorrect while an attacker-controlled phishing kit running in the background harvests their credentials.
What sets this campaign apart is the fact that cybercriminals behind it went to great lengths to encode the HTML file in such a way to bypass security controls. As always, users should avoid opening emails from unknown senders especially when they require them to login into an online service to access a file or request that they enable macros.
- We've also highlighted the best endpoint protection software
