Phishing Actors Return to ‘Good Old’ Morse Code for Obfuscation

  • Microsoft noticed the use of Morse code in a year-long phishing campaign that went through several method changes.
  • The actors tried many things to evade detection and increase their success rates, but Morse code wasn’t very effective.
  • Simply setting HTML files to be stripped in your inbox policies would render these phishing efforts impotent.

It appears that phishing actors rotate their encryption and obfuscation methods so frequently that passing through some classics like using Morse code is inevitable even if it has been proven to be largely ineffective multiple times in the recent past. As Microsoft’s Threat Intelligence team reports, phishing campaigns change tricks every 37 days on average, testing out new obfuscation methods and evaluating them based on the success rates against the targets. Microsoft followed a particular campaign from July 2020 to July 2021, recording the following evolution in the actors’ methods.

Source: Microsoft

The use of Morse code first appeared in February 2021 and then returned for a second run in May 2021. Morse code is an old Latin text encoding method that uses dots and dashes, appreciated for its simplicity and reliability in telecommunications, aviation, radio, assistive technology, navigation, and other special cases. In computing, though, it is pretty unusual as it’s neither efficient nor very effective. The phishing actors still gave it a try twice, encoding their JavaScript in February in ASCII and then Morse, while in May, they went straight from HTML to Morse.

Source: Microsoft

Apart from the actual phishing that typically involved the abuse of Office 365 logos and login prompts, the actors also delivered an info-stealing module starting in May 2021, which was capable of fetching credentials automatically, as well as the user’s IP address and country data. In some cases, Microsoft noticed the actors using the organization's logo the target worked for, so there was clearly some level of reconnaissance operations involved, too, depending on the perceived value of the victim.

On the matter of the success that this campaign had in the wild, it is obvious that Microsoft could follow it closely. Hence, the actors never really managed to fly under the radar no matter how many times they tried to bypass detection systems. The Defender for Office 365 checks the email header properties, the sender’s IP address reputation, “detonates” files and URLs in its built-in sandbox, and tests JavaScript files on the fly in a contained environment. As such, no matter the obfuscation, Defender’s checks will determine what is spoofed and what’s legitimate.

To stay safe against these attacks, set your mail flow rules or Group Policy for Outlook to strip .HTML and .HTM file types that aren’t required for business anyway, turn on “Safe Attachments” and “Safe Links,” and finally activate 2FA on your account.

REVIEW OVERVIEW

Latest

Why Is Demon Slayer So Popular?

In August 2019, the world suddenly started talking about an anime series that had just released its nineteenth episode. Fast forward to...

F1 Live Stream 2022: How to Watch Formula 1 Without Cable

There's not much time until the 2022 Formula 1 World Championship gets underway - the first race is scheduled for late March,...

Disney+ Announces Basketball Series Inspired By Award-Winning Book The Crossover

Disney Plus announced a new basketball-themed drama series that is set to land on the streaming platform, drawing inspiration from the critically...
For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: Chrome, Edge, Firefox, Safari