Rewterz Threat Alert – Major US-based bank employees phished with Custom Web Fonts meant to Evade Detection

(Attackers are getting creative with their phishing gear!!!)

SEVERITY: MEDIUM

CATEGORY: PHISHING

ANALYSIS SUMMARY

A new phishing campaign has been discovered using a peculiar kind of technique to evade detection. The phishing toolkit hides the source code of its landing page in custom web fonts and aims to steal credentials from customers and employees of a major U.S.-based bank.

Clicking on the phishing email, targets are redirected to a landing page that looks exactly like the log-in page of a major US-based bank. This seems to be a normal credential harvesting email campaign until we see how the attackers hide their tracks to appear harmless. Encoded source codes aren’t anything new, but this campaign uses custom web fonts for the ciphering.

The source code of the page has encoded display text which remains as it is even when it has been copied and pasted into a text file. Behind this trick are Web Open Font Format (WOFF) files, which are web font files created in an open format that delivers webpage fonts. The base64-encoded woff and woff2 files install a substitution cipher.

Essentially the substitution ciphers replace the expected alphabetical letters shown to the victim on the page (“abcdefghi…”) with other letters in the source code. This substitution cipher results in a perfectly harmless-looking landing page and the browser renders the ciphertext as plaintext. Have a look at the resulting ciphertext below.

Another new thing that researchers found out was that the page source did not have JavaScript functions to enable the use of the character substitution cypher; instead, they made use of the CSS code.

Also, the Bank’s branding was used in scalable vector graphics format, so that the logo and its source do not appear in the source code and therefore will not be detected by the forged brand. Even though this recently discovered campaign can potentially be traced back to May 2018, a number of active domains are still found to be hosting the kit.

Simple as it may look, the implementation via web font files is a unique fraudulent tactic now being used in phishing attacks to fool unsuspecting targets.

INDICATORS OF COMPROMISE

• fatima133777@gmail[.]com
• fitgirlp0rtia@gmail[.]com
• hecklerkiller@yandex[.]com
• netty6040@aol[.]com
• nicholaklaus@yandex[.]com
• oryodavied@gmail[.]com
• realunix00@gmail[.]com
• slidigeek@gmail[.]com
• zerofautes@outlook[.]com

REMEDIATION 

With the evolution in phishing techniques, the conventional methods of identifying spoofed landing pages seem to be expiring. Therefore, the best remedy is to stay alert at all times and to never click on links. Instead, users should directly type in the web address of websites they want to visit.

Also, consider blocking the threat indicators at their respective controls.