Blog

Inside the SOC

Bytesize security: HTML phishing attachments

Bytesize security: HTML phishing attachmentsDefault blog imageDefault blog image
11
Aug 2022
11
Aug 2022

One of the most common types of phishing email seen by the Darktrace SOC, involves the use of HTML attachments (Figure 1). These emails make use of an attachment to hide redirects to overtly malicious or suspicious domains. Some even impersonate legitimate web pages and send any entered or captured information back to the attacker's infrastructure once opened or filled out by the recipient. Indicators of these attempts can be identified from a few key patterns found across multiple emails.

Figure 1: An example of a suspicious HTML attachment containing dynamic content


A typical feature of these HTML attachments is the use of a generic-sounding filename that relates to the message's subject line, but with no specific information pertaining to the recipient or their line of business. These files almost always contain some form of Javascript code, as they often make use of external Javascript libraries to accomplish whatever goal is being pursued. For example, an attacker might use Javascript to convincingly impersonate a trustworthy website and trick the recipient into providing credentials or sensitive information, or they might use it deploy malware and get a foothold on the device for further compromise once opened. This can often be further identified by the presence of certain links in the HTML file itself (Figure 2).

Figure 2: The HTML file previously referenced contained multiple rare and suspicious links

Figure 2 above is an example of an HTML file containing multiple links with calls for .js files. This shows that the attachment contains Javascript and is making calls for external libraries for an undetermined purpose. 

Another common red flag is when the file contains links to common Product or Service images from domains wholly unrelated to those services, as seen below (Figure 3).

Figure 3: An example of an unusual .png call from a rare domain. The subsequent image called is for a company with no apparent relation to the hosting domain

The examples above imply an obvious (and poor) attempt by the HTML file to impersonate a Microsoft webpage, likely a fake login page set up for credential harvesting, as the ‘Microsoft’ logo is being pulled from a domain entirely unrelated to Microsoft or any common image-hosting service. 

Rather than impersonating a website directly in the file and loading resources from external sources, these HTML files will instead directly point toward a webpage that already contains these elements. This comes with its own set of pros and cons: by hosting their phishing page in a public setting, they are far more likely to be taken down, however it may be easier to appear legitimate than if they were to build it all out in the HTML file itself. 

The final routine element in these types of HTML phishing emails is the mechanism by which the attacker intends to receive any successfully scammed credentials or information. If the fake webpage is entirely contained in the HTML file, this often presents as a suspicious PHP link present in the file itself (Figure 4).

Figure 4: Phishing HTMLs often include links to rare domains with PHP destinations as an indication that it will engage in some form of HTTP POST communication

PHP calls suggest that some part of the webpage is intended to submit an HTTP POST or equivalent ‘submission’ call, often present in the ‘Login’ button in these scenarios. After the victim clicks this button, the webpage sends all the form-submission items to the endpoint hosting the PHP page, which is commonly an indicator of the webserver hosting the attacker infrastructure running the phishing attack.

If the HTML file redirects to an externally hosted phishing page, identical PHP links are often found in the source code of those pages (Figure 5). This serves the same function as sending any entered credentials back to the attacker.

Figure 5: The source-code of an external-hosted phishing page, showing calls for PHP pages hosted on alternate attacker infrastructure

The process of HTML attacks is so standardized that they are commonly released in the form of easily deployable phishing kits. These can be deployed on unsuspecting compromised webservers with little to no modification, resulting in virtually identical attacks being seen year-round. WordPress seems to be a prime target for hosting such attacks, with the site owners often becoming unsuspecting victims in propagating these phishing campaigns. An unfortunate side effect of these kits being readily available is that the attackers often don't bother to set any sort of access restrictions on their phishing servers once established, which can result in their entire setup being publicly viewable with a simple link modification. One example is seen below (Figure 6).

Figure 6: The parent directory of the website hosting a suspicious PHP page was fully accessible without restriction

In this incident, the website hosting the PHP link seen earlier had a publicly accessible parent directory structure, where both the PHP file above and an additional suspicious .txt file could be seen. This .txt file appears to be where any information submitted by victims ultimately ended up written to (Figure 7).

Figure 7: The TXT file in the parent directory above appeared to contain the login information that was likely submitted to the PHP page referred to in the initial HTML attachment

Figure 7 above presents the unusual risk of not only having the victims’ credentials at the disposal of the original attacker, but also potentially exposed to any malicious actor that can get creative with a web-crawler to identify key elements of the files used by these particular phishing kits. 

Fortunately, due to the standardized nature of these ready-made phishing kits, these types of attacks often conform to a series of common behaviors that Darktrace/Email excels in identifying. Despite being a popular technique, it is extremely rare for attempts using this HTML attachment method to successfully get through a correct Darktrace/Email deployment. Overall, this means one less risk for the end user to worry about.

Like this and want more?

Receive the latest blog in your inbox
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
INSIDE THE SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
AUTHOR
ABOUT ThE AUTHOR
Connor Mooney
SOC Analyst
PRODUCT SPOTLIGHT
No items found.
COre coverage
No items found.
This Article
Bytesize security: HTML phishing attachments
Share
Twitter logoLinkedIn logo

Good news for your business.
Bad news for the bad guys.

Start your free trial

Start your free trial

Flexible delivery
You can either install it virtually or with hardware.
Fast install
Just 1 hour to set up – and even less for an email security trial.
Choose your journey
Try out Self-Learning AI wherever you most need it — including cloud, network or email.
No commitment
Full access to the Darktrace Threat Visualizer and three bespoke Threat Reports, with no obligation to purchase.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Get a demo

Flexible delivery
You can either install it virtually or with hardware.
Fast install
Just 1 hour to set up – and even less for an email security trial.
Choose your journey
Try out Self-Learning AI wherever you most need it — including cloud, network or email.
No commitment
Full access to the Darktrace Threat Visualizer and three bespoke Threat Reports, with no obligation to purchase.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.