Security News > 2021 > August > Hackers Spotted Using Morse Code in Phishing Attacks to Evade Detection

Microsoft has disclosed details of an evasive year-long social engineering campaign wherein the operators kept changing their obfuscation and encryption mechanisms every 37 days on average, including relying on Morse code, in an attempt to cover their tracks and surreptitiously harvest user credentials.

The phishing attacks take the form of invoice-themed lures mimicking financial-related business transactions, with the emails containing an HTML file.

"The HTML attachment is divided into several segments, including the JavaScript files used to steal passwords, which are then encoded using various mechanisms. These attackers moved from using plaintext HTML code to employing multiple encoding techniques, including old and unusual encryption methods like Morse code, to hide these attack segments".

Microsoft said it detected the use of Morse code in the attacks' February and May 2021 waves, while later variants of the phishing kit were found to direct the victims to a legitimate Office 365 page instead of showing a fake error message once the passwords were entered.

"Email-based attacks continue to make novel attempts to bypass email security solutions," the researchers said.

"In the case of this phishing campaign, these attempts include using multilayer obfuscation and encryption mechanisms for known existing file types, such as JavaScript. Multilayer obfuscation in HTML can likewise evade browser security solutions."

News URL

http://feedproxy.google.com/~r/TheHackersNews/~3/wfPLnvmlFL4/hackers-spotted-using-morse-code-in.html