Researchers at Avanan, A Check Point Company, have revealed its latest research analyzing how hackers hide malicious content inside “blank images,” creating automatic redirects that bypass anti-malware checks.
- This technique adds a layer of sophistication to malicious HTML attachments with the <meta> tag, obfuscating the URL to evade link analysis and redirect to a compromised domain.
- This email campaign starts with what appears to be a document from DocuSign, requesting the user to review and sign the document.
- The document provides an HTM attachment containing an empty SVG image; clicking on the image within the document automatically redirects visitors to a malicious URL.
Jeremy Fuchs, Cybersecurity Researcher/Analyst at Avanan had this comment:
“Hackers can target practically anyone with this technique. Like most attacks, the idea is to use it to get something from the end-user. Any user with access to credentials or money is a viable target. HTM attachments aren’t new, nor are using Base64 trickery. What is new and unique is using an empty image with active content inside–a javascript image–which redirects to a malicious URL. It’s essentially using a dangerous image, with active content inside that traditional services like VirusTotal don’t detect.”
You can read the full report here. It also has defence strategies in the report that you will find useful as well.
Like this:
Like Loading...
Related
This entry was posted on January 19, 2023 at 9:00 am and is filed under Commentary with tags Avanan. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
New Email Phishing Attack: Hackers Hide Malware in Blank SVG Image via DocuSign HTML Attachment
Researchers at Avanan, A Check Point Company, have revealed its latest research analyzing how hackers hide malicious content inside “blank images,” creating automatic redirects that bypass anti-malware checks.
Jeremy Fuchs, Cybersecurity Researcher/Analyst at Avanan had this comment:
“Hackers can target practically anyone with this technique. Like most attacks, the idea is to use it to get something from the end-user. Any user with access to credentials or money is a viable target. HTM attachments aren’t new, nor are using Base64 trickery. What is new and unique is using an empty image with active content inside–a javascript image–which redirects to a malicious URL. It’s essentially using a dangerous image, with active content inside that traditional services like VirusTotal don’t detect.”
You can read the full report here. It also has defence strategies in the report that you will find useful as well.
Share this:
Like this:
Related
This entry was posted on January 19, 2023 at 9:00 am and is filed under Commentary with tags Avanan. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.