{"id":95616,"date":"2021-08-12T09:00:09","date_gmt":"2021-08-12T16:00:09","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=95616"},"modified":"2023-08-03T14:41:04","modified_gmt":"2023-08-03T21:41:04","slug":"attackers-use-morse-code-other-encryption-methods-in-evasive-phishing-campaign","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/12\/attackers-use-morse-code-other-encryption-methods-in-evasive-phishing-campaign\/","title":{"rendered":"Attackers use Morse code, other encryption methods in evasive phishing campaign"},"content":{"rendered":"

Cybercriminals attempt to change tactics as fast as security and protection technologies do. During our year-long investigation of a targeted, invoice-themed XLS.HTML phishing campaign, attackers changed obfuscation and encryption mechanisms every 37 days on average, demonstrating high motivation and skill to constantly evade detection and keep the credential theft operation running.<\/p>\n

This phishing campaign exemplifies the modern email threat: sophisticated, evasive, and relentlessly evolving. The HTML attachment is divided into several segments, including the JavaScript files used to steal passwords, which are then encoded using various mechanisms. These attackers moved from using plaintext HTML code to employing multiple encoding techniques, including old and unusual encryption methods like Morse code, to hide these attack segments. Some of these code segments are not even present in the attachment itself. Instead, they reside in various open directories and are called by encoded scripts.<\/p>\n

In effect, the attachment is comparable to a jigsaw puzzle: on their own, the individual segments of the HMTL file may appear harmless at the code level and may thus slip past conventional security solutions. Only when these segments are put together and properly decoded does the malicious intent show.<\/p>\n

This campaign\u2019s primary goal is to harvest usernames, passwords, and\u2014in its more recent iteration\u2014other information like IP address and location, which attackers use as the initial entry point for later infiltration attempts. As we previously noted<\/a>, the campaign components include information about the targets, such as their email address and company logo. Such details enhance a campaign\u2019s social engineering lure and suggest that a prior reconnaissance of a target recipient occurs.<\/p>\n

Email-based attacks continue to make novel attempts to bypass email security solutions. In the case of this phishing campaign, these attempts include using multilayer obfuscation and encryption mechanisms for known existing file types, such as JavaScript. Multilayer obfuscation in HTML can likewise evade browser security solutions.<\/p>\n

To defend organizations against this campaign and similar threats, Microsoft Defender for Office 365<\/a> uses multiple layers of dynamic protection technologies backed by security expert monitoring of email campaigns. Rich email threat data from Defender for Office 365 informs Microsoft 365 Defender<\/a>, which provides coordinated defense against follow-on attacks that use credentials stolen through phishing. Microsoft 365 Defender does this by correlating threat data from email, endpoints, identities, and cloud apps to provide cross-domain defense.<\/p>\n

XLS.HTML phishing campaign: Fake payment notices are effective tool for attackers to steal credentials<\/h2>\n

The XLS.HTML phishing campaign uses social engineering to craft emails mimicking regular financial-related business transactions, specifically sending what seems to be vendor payment advice. In some of the emails, attackers use accented characters in the subject line.<\/p>\n

The email attachment is an HTML file, but the file extension is modified to any or variations of the following:<\/p>\n