Chameleons Phish, Too
One of the challenges cyber criminals face is that their scams often have a relatively short shelf-life. Once they’ve been used, the gaff is quickly blown, and the scammers hope to realize their gains before most of the potential marks are wise to the scam.
Researchers at Trustwave describe a way in which criminals are trying to get more mileage out of their coding, specifically by developing “chameleon” phishing pages that adapt to their victims’ expectations and so escape exposure. They’re turning up in scams that seek to harvest credentials from unwary victims.
“Recently, we encountered an interesting phishing webpage that caught our interest because it acts like a chameleon by changing and blending its color based on its environment. In addition, the site adapts its background page and logo depending on user input to trick its victims into giving away their email credentials,” the researchers say. “This custom phishing site acts like a chameleon, by changing and blending its images to camouflage itself. There were four noticeable web elements that changed whenever we tested a crafted email address in the browser:
- “The page’s background
- “A blurred logo
- “The title tab
- “The capitalized text of the domain from the email address provider.”
The goal, again, is to give the scam legs, to enable it to stay in use longer. Here’s an example of how it changes for Gmail vs Outlook:
Source: Trustwave
“Phishing webpages are often taken down in a matter of minutes or become unavailable as soon as information security companies detect them as being malicious,” Trustwave explains. “These templated, or so-called chameleon phishing sites, are used repeatedly by malware authors using the clever tricks we just detailed to fool the user into thinking these pages are real. The phishers can easily customize the template and use other domains to host these scripts, allowing attackers to prey on unsuspecting users over and over again.”
Chameleon phishing sites represent another move toward commodifying malware and scamming techniques. New school security awareness training can help users see through the impostures that make their way through an organization’s filters.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW