Skip to content

Phishing

A Closer Look At Modern Evasive Phishing Emails

E. Boulila, M. Dacier, S. P. V. Peroumal, N. Veys and S. Aonzo
55th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN 2025)
https://www.eurecom.fr/publication/8200/download/sec-publi-8200.pdf

  • Exhaustive analysis of user-reported phishing messages pertaining to five companies over a ten-month period. These messages are of particular interest as they evaded all state of the art security layers in place and were identified by the recipients themselves.

  • We gathered 1,551 user-reported messages that were confirmed to be malicious, with a particular focus on those targeting the harvesting of corporate credentials.

  • Our findings indicate that:

  • The majority of observed phishing attacks are low-volume but meticulously planned, exhibiting a high degree of premeditation and strategic preparation. Infrequent campaigns against which automated systems have received limited data, thereby impeding their ability to detect them on a large scale.
  • A substantial number of sites were registered and had obtained TLS certificates several weeks before the attacks in order to avoid being flagged based on their young age, a common practice used by products to defeat phishing websites.
  • Phishing pages are now safeguarded by advanced evasion mechanisms, such as bot detection services and open-source fingerprinting libraries.

  • QR codes are increasingly used to embed phishing content. Access to the website will not be done from the corporate machine protected by the corporate defenses but from the smartphone that flashes the QR code. As of now, most personal smartphones are typically less monitored and protected than machines in the corporate network.

  • To send the message, attackers may use:

  • compromised email servers
  • compromised email accounts
  • third-party services
  • malicious sender accounts.
  • They may also employ domain spoofing or email header manipulation to disguise the true origin of the message.
  • All the reported messages pass the three email authentication methods: SPF, DKIM, and DMARC.
  • This means that they are either sent from legitimate, well established email addresses or from compromised or malicious accounts.

Evasion

  • The evasion techniques employed to bypass the email security parsers and scanners can be categorized into two distinct classes.
  • Message-level evasion: it refers to techniques used to hide an embedded URL in a message, such that it is not successfully retrieved by email security parsers. It can be based for instance on obfuscation, character substitution, and character encoding (where parts of the message are encoded in Base64 for example). Attackers might also embed malicious text in images to evade text-based filters.

  • Cloaking: it refers to techniques used when a client visits a phishing website. The goal is to conceal the phishing page from web crawlers and security bots, while keeping it visible to human victims. If the visitor is identified as a bot, a benign content is displayed.

  • Client-side cloaking involves techniques executed within the user’s browser or system. Some checks are run on the client to collect information about the environment or the user’s behavior. Depending on the result, a different content is displayed to the visitor (benign or malicious).

  • User interaction: the phishing content remains hidden until a button in a pop-up window is clicked or if a mouse activity is detected. In other cases, user interaction such as scrolling or filling out form fields are needed to show the malicious content.
  • Fingerprinting: if the cookies are disabled or if the browser cache is enabled, the client is detected as an automated environment and the phishing page is not displayed.
    • This detection can also be made based on the origin of the traffic (by checking the Referrer field), or on the user agent string, accessed via the navigator.userAgent property. Some additional checks can be made based on attributes like the screen resolution for instance.

  • Bot behavior: the phishing content is randomly displayed or is delayed by a few seconds. While scanning a URL, some security crawlers do not wait enough time before the page is reloaded with malicious content. This leads to a false negative verdict. Additionally, Google reCaptcha was seen in previous phishing campaigns since at least 202]. It presents the user with the ”I’m not a robot” checkbox, prompting them to solve image-based puzzles.

  • Server-side cloaking is executed on the phishing server itself. In this case, the server decides what content to serve based on attributes of the incoming request, such as IP address or User-Agent. The phishing content is only displayed to targeted users.

  • Delaying the activation of a phishing URL: before its activation, all visitors are redirected to a benign page. This technique can be used to prevent email security filters from reaching the malicious page while scanning the URL extracted from an incoming message.
    • For example, attackers might choose to send a phish message when the victim is supposed to be unavailable (in the middle of the night for instance). At delivery time, the URL does not display any malicious content. A few hours later, the URL is activated.
  • User Agent filtering: the phishing content is only accessible for specific clients, for example the ones associated with a mobile browser (such as Safari on iOS). This technique might be part of the attacker’s strategy, for instance, when the phishing URL is embedded in a QR code, which should normally be decoded by a mobile phone, not a desktop o a laptop.
  • IP blacklists: used to block access to clients whose IPs are associated to known security scanners.
  • Displaying the phishing site only if the GET request is made to a valid tokenized URL: The attacker generates URLs containing unique tokens. For example, a URL might look like the following: https://evil-site.com/dhfYWfH, where the token is ”dhfYWfH”. Any request lacking a valid token is redirected to a benign webpage. Additionally, attackers can disable individual tokens, preventing even those URLs from displaying the phishing content.

Email volume

  • In total, these companies handle over 60 million inbound emails monthly.
  • The companies maintain a robust awareness policy, actively encouraging their staff and consultants to report any suspicious emails they receive and frequently engaging them in phishing simulation campaigns.
  • These email messages are initially intercepted and analyzed by state of the art security products.
  • At this stage, 17% of all messages are filtered out because they were detected as malicious or spam.
  • Among the remaining 83%, about 14,000 are monthly reported as suspicious by end-users (corresponding to 0.03% of the total delivered messages).
  • Among the reported emails, about 3.7% are found to be malicious
  • The rest are flagged as either legitimate (35.0%) or spam (61.3%).

  • In absolute numbers, 500 are reported and confirmed as malicious every month, i.e., 25 per working day on average.

  • 29.9% correspond to active phishing; namely, such emails redirect to a web page with a fake login form.

  • 49.6% of the messages do not contain any embedded web resources (such as URLs); these are generally associated with fraud when attackers try to establish first contact with the recipient.
  • 15.9% lead to error pages (NXDomain error, page unreachable, etc.), despite our efforts to analyze them in real time. These instances might correspond to phishing websites that had been deactivated or server-side cloaking that we could not circumvent.
  • 4.5% lead to pages requiring specific user interaction (e.g., a Dropbox document, a Google Drive page, or a website requiring solving a traditional CAPTCHA system involving image-based puzzles).
  • Only five (0.1%) messages resulted in the download of external files, specifically ZIP archives. Each archive contains an HTA (HTML Application) file that retrieves a JavaScript file from a domain identified as malicious by VirusTotal.

Login pages

  • After identifying the phishing URLs leading to fake lookalike login pages, we inspect the requests made by our automated browser while visiting these pages.
  • In 339/1,137 cases (29.8%), the client downloads in real-time embedded resources, including the logo and the background image from the third-party domains belonging to the organization being impersonated.

  • This is a crucial observation because by identifying referrals in requests made for the aforementioned web resources within their own systems, organizations can track, at early stages, pages impersonating their login sites.

  • The median time for delivering a phishing message is approximately:

  • 24 days after creating the landing domain

  • 8 days after issuing the associated TLS certificate.

  • The number of reported messages linked to the identified landing domains is:

  • Average 2.62.
  • Median number is only 1.0.
  • This suggests that many of these phishing attempts may be part of more targeted attacks rather than large-scale phishing campaigns. This could indicate that a significant portion of the associated landing domains could be designed for specific, low-volume operations, making them harder to detect in targeted scenarios.