Blog

Inside the SOC

Bytesize security: HTML phishing attachments

Bytesize security: HTML phishing attachmentsDefault blog imageDefault blog image
11
Aug 2022
11
Aug 2022

One of the most common types of phishing email seen by the Darktrace SOC, involves the use of HTML attachments (Figure 1). These emails make use of an attachment to hide redirects to overtly malicious or suspicious domains. Some even impersonate legitimate web pages and send any entered or captured information back to the attacker's infrastructure once opened or filled out by the recipient. Indicators of these attempts can be identified from a few key patterns found across multiple emails.

Figure 1: An example of a suspicious HTML attachment containing dynamic content


A typical feature of these HTML attachments is the use of a generic-sounding filename that relates to the message's subject line, but with no specific information pertaining to the recipient or their line of business. These files almost always contain some form of Javascript code, as they often make use of external Javascript libraries to accomplish whatever goal is being pursued. For example, an attacker might use Javascript to convincingly impersonate a trustworthy website and trick the recipient into providing credentials or sensitive information, or they might use it deploy malware and get a foothold on the device for further compromise once opened. This can often be further identified by the presence of certain links in the HTML file itself (Figure 2).

Figure 2: The HTML file previously referenced contained multiple rare and suspicious links

Figure 2 above is an example of an HTML file containing multiple links with calls for .js files. This shows that the attachment contains Javascript and is making calls for external libraries for an undetermined purpose. 

Another common red flag is when the file contains links to common Product or Service images from domains wholly unrelated to those services, as seen below (Figure 3).

Figure 3: An example of an unusual .png call from a rare domain. The subsequent image called is for a company with no apparent relation to the hosting domain

The examples above imply an obvious (and poor) attempt by the HTML file to impersonate a Microsoft webpage, likely a fake login page set up for credential harvesting, as the ‘Microsoft’ logo is being pulled from a domain entirely unrelated to Microsoft or any common image-hosting service. 

Rather than impersonating a website directly in the file and loading resources from external sources, these HTML files will instead directly point toward a webpage that already contains these elements. This comes with its own set of pros and cons: by hosting their phishing page in a public setting, they are far more likely to be taken down, however it may be easier to appear legitimate than if they were to build it all out in the HTML file itself. 

The final routine element in these types of HTML phishing emails is the mechanism by which the attacker intends to receive any successfully scammed credentials or information. If the fake webpage is entirely contained in the HTML file, this often presents as a suspicious PHP link present in the file itself (Figure 4).

Figure 4: Phishing HTMLs often include links to rare domains with PHP destinations as an indication that it will engage in some form of HTTP POST communication

PHP calls suggest that some part of the webpage is intended to submit an HTTP POST or equivalent ‘submission’ call, often present in the ‘Login’ button in these scenarios. After the victim clicks this button, the webpage sends all the form-submission items to the endpoint hosting the PHP page, which is commonly an indicator of the webserver hosting the attacker infrastructure running the phishing attack.

If the HTML file redirects to an externally hosted phishing page, identical PHP links are often found in the source code of those pages (Figure 5). This serves the same function as sending any entered credentials back to the attacker.

Figure 5: The source-code of an external-hosted phishing page, showing calls for PHP pages hosted on alternate attacker infrastructure

The process of HTML attacks is so standardized that they are commonly released in the form of easily deployable phishing kits. These can be deployed on unsuspecting compromised webservers with little to no modification, resulting in virtually identical attacks being seen year-round. WordPress seems to be a prime target for hosting such attacks, with the site owners often becoming unsuspecting victims in propagating these phishing campaigns. An unfortunate side effect of these kits being readily available is that the attackers often don't bother to set any sort of access restrictions on their phishing servers once established, which can result in their entire setup being publicly viewable with a simple link modification. One example is seen below (Figure 6).

Figure 6: The parent directory of the website hosting a suspicious PHP page was fully accessible without restriction

In this incident, the website hosting the PHP link seen earlier had a publicly accessible parent directory structure, where both the PHP file above and an additional suspicious .txt file could be seen. This .txt file appears to be where any information submitted by victims ultimately ended up written to (Figure 7).

Figure 7: The TXT file in the parent directory above appeared to contain the login information that was likely submitted to the PHP page referred to in the initial HTML attachment

Figure 7 above presents the unusual risk of not only having the victims’ credentials at the disposal of the original attacker, but also potentially exposed to any malicious actor that can get creative with a web-crawler to identify key elements of the files used by these particular phishing kits. 

Fortunately, due to the standardized nature of these ready-made phishing kits, these types of attacks often conform to a series of common behaviors that Darktrace/Email excels in identifying. Despite being a popular technique, it is extremely rare for attempts using this HTML attachment method to successfully get through a correct Darktrace/Email deployment. Overall, this means one less risk for the end user to worry about.

More in this series:

該当する項目はありません。

Like this and want more?

Receive the latest blog in your inbox
ありがとうございます!あなたの投稿を受け取りました。
フォームを送信する際に何らかの問題が発生しました。
INSIDE THE SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
AUTHOR
ABOUT ThE AUTHOR
Connor Mooney
SOC Analyst
share this article
PRODUCT SPOTLIGHT
該当する項目はありません。
COre coverage
該当する項目はありません。

Good news for your business.
Bad news for the bad guys.

無償トライアルを開始

無償トライアルを開始

柔軟な導入
仮想的にインストールすることも、ハードウェアでインストールすることも可能です。
迅速なインストール
設定時間はわずか1時間、メールセキュリティのトライアルはさらに短時間で完了します。
製品を選ぶ
クラウド、ネットワーク、Eメールなど、最も必要とされる領域で自己学習型AIの能力をお試しください。
購入義務なし
Darktrace Threat Visualizerと組織毎にカスタマイズされた3回の脅威レポートへのフルアクセスを提供しますが、購入の義務はありません。
For more information, please see our Privacy Notice.
ありがとうございます!あなたの投稿を受け取りました。
フォームを送信する際に何らかの問題が発生しました。

デモを見る

柔軟な導入
仮想的にインストールすることも、ハードウェアでインストールすることも可能です。
迅速なインストール
設定時間はわずか1時間、メールセキュリティのトライアルはさらに短時間で完了します。
製品を選ぶ
クラウド、ネットワーク、Eメールなど、最も必要とされる領域で自己学習型AIの能力をお試しください。
購入義務なし
Darktrace Threat Visualizerと組織毎にカスタマイズされた3回の脅威レポートへのフルアクセスを提供しますが、購入の義務はありません。
ありがとうございます!あなたの投稿を受け取りました。
フォームを送信する際に何らかの問題が発生しました。

Check out this article by Darktrace: Bytesize security: HTML phishing attachments