{
  "timestamp": "2025-02-05T22:44:28.463047",
  "content": "Search Free Trial Get Demo JavaScript Obfuscation in Phishing Sites December 2, 2021 Weve all experienced the typical phishing site where the attacker asks that you enter your credentials while the sketchy Microsoft logo on top of the page makes you feel comfortable doing so. Those phishing sites used to be easy to recognize the simple behind-the-scenes code would reveal the sites identity, functions, information delivery methods and where the data was being sent to. The detection tools have evolved and become more sophisticated, but so have the phishing creators. For this reason, securing Microsoft Office 365 has become harder. One of the strategies the attackers use to elevate the complexity of a phishing site and evade detection by existing organizational mechanisms is obfuscation of the phishing site code. This includes using an obfuscated redirection site whose sole purpose is to redirect the user to the actual phishing site while avoiding detection. The most common method to do so is JavaScript obfuscation the code of a phishing attack is made obscure and unintelligible so it cannot be read easily. Lets see how the attacker creates an obfuscated redirection site. Sidenote this task is typically performed using a phishing kit, but we will be looking at the manual process. First, a regular phishing site with a common login Office 365, for example is built. Then the source code and the functions are written, just like for any other website. When those are ready, the attacker obfuscates JavaScript to scramble the code. As a result, the regular function names are replaced by random numbers and letters, creating an array of loops to confuse the detection tools and pass the defense, eventually reaching the victim. Thats not all, however. The attacker will not just send the sites URL directly to the victim  they would create another site, either with its own domain or with a compromised one, employing multiple functions and loops usually implemented using base64 to redirect the victim to the actual phishing site. This creates yet another layer of evasion from the detection tools. Lets go over this process step by step. The phishing source site can be something as simple as one function When obfuscated, the code becomes unreadable and hard to understand Initially, the victim wont get the original URL but rather a redirecting one when clicked, it will take the victim to a phishing site. If you encounter a site with similar characteristics, you would be well advised to close it and report the email sender. Legitimate sites wouldnt use a scrambled code that has loops and meaningless JavaScript functions. Lets demonstrate this using the Office 365 login source code The code from the Microsoft site is easily readable and well organized, no weird functions or parameters are found. On an obfuscated site, however, the code is not so easy to interpret. In the example below, note the suspicious var enablebase64 parameter that we know is part of the obfuscation functions and the var redirectUrl parameter of the redirection URL that takes you to the actual phishing site Lets summarize some basic practices that will help you identify a phishing site, stop a potential phishing attack , and stay safe. Stop . Do not open links from any sender . Always check the senders address and not just what the email subject and title say. Observe . You have checked the senders email address and it seems okay. Now ask yourself if you are supposed to be getting emails from that sender. Suspect . The sender looks legitimate, but you are not sure if you were supposed to receive anything from him or her. STOP. Dont click. Take a good look at the URL and the site name. Do they look suspicious to you? Is the site name spelled correctly? Does the URL look real and related to the email senders domain? Interrogate . Everything looks right, but you are not fully convinced. Check the source code and re-read this blog article to identify the possible suspicious code indicators. Always keep in mind the golden phishing prevention steps Stop, Observe, Suspect, and Interrogate. If youve taken all four, you should be fine. Read this other blog for more tips and additional detail. See Cyren in action with the Cyren Inbox Security demo. Get the Demo Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Human  Machine  Cyren Inbox Security and KnowBe4 Phishing Targets Phantom Wallet Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443",
  "analysis_type": "user_guidance",
  "analysis": "**Guidance on Protecting Against Phishing Attacks with Obfuscated Code**\n\nPhishing attacks have become increasingly sophisticated, with attackers using techniques like JavaScript obfuscation to evade detection. Here's how you can protect yourself and your data:\n\n### 1. Security Best Practices\n\n- **Verify Senders**: Always check the sender's email address. Look for misspellings or unusual domains that might indicate fraud.\n- **\u907f\u514d\u70b9\u51fb\u4e0d\u660e\u94fe\u63a5**: Hover over links to preview URLs before clicking. Ensure the domain matches the context (e.g., microsoft.com vs. micros0ft.com).\n- **\u542f\u7528\u53cc\u56e0\u7d20\u8ba4\u8bc1 (MFA)**: Add an extra layer of security to your accounts by enabling MFA wherever possible.\n\n### 2. Data Protection Recommendations\n\n- **\u4f7f\u7528\u5b89\u5168\u5bc6\u7801**: Use complex, unique passwords for each account. Consider a password manager to securely store them.\n- **\u5b9a\u671f\u66f4\u65b0\u8f6f\u4ef6**: Keep your browser, operating system, and antivirus software updated to protect against vulnerabilities.\n\n### 3. Safe Usage Guidelines\n\n- **\u8bc6\u522b\u53ef\u7591\u7f51\u7ad9**: Be cautious of sites with spelling mistakes, unusual URLs, or those that prompt you to enter credentials unexpectedly.\n- **\u68c0\u67e5\u7f51\u7ad9\u4ee3\u7801**: If unsure, view the page source (right-click > View Page Source) to look for obfuscated or scrambled code, which may indicate phishing.\n\n### 4. Common Security Risks and Prevention\n\n- **\u9493\u9c7c\u90ae\u4ef6**: Be wary of emails requesting urgent action, such as password resets, especially from unfamiliar senders.\n- **\u793e\u4ea4\u5de5\u7a0b\u653b\u51fb**: Attackers may impersonate trusted individuals. Verify requests through a separate communication channel if unsure.\n\n### 5. Privacy Protection Measures\n\n- **\u4fdd\u62a4\u4e2a\u4eba\u4fe1\u606f**: Avoid sharing sensitive information online unless necessary. Use privacy tools to mask email addresses and phone numbers where possible.\n- **\u4f7f\u7528\u9690\u79c1\u6d4f\u89c8\u6a21\u5f0f**: Consider using private browsing sessions to limit tracking and data collection.\n\n### 6. When to Seek Additional Security Support\n\n- **\u62a5\u544a\u53ef\u7591\u6d3b\u52a8**: If you encounter a suspicious site or email, report it to your IT department or security team immediately.\n- **\u5bfb\u6c42\u4e13\u5bb6\u5e2e\u52a9**: If you believe your account has been compromised, contact your organization's support team for assistance in securing your account.\n\n### Additional Tips\n\n- **\u6559\u80b2\u548c\u57f9\u8bad**: Regularly participate in cybersecurity training to stay informed about the latest threats and tactics.\n- **\u4f7f\u7528\u5b89\u5168\u5de5\u5177**: Install browser extensions that block known phishing sites and check URLs for safety.\n\nBy following these guidelines, you can significantly reduce the risk of falling victim to phishing attacks and protect your data effectively. Stay vigilant and proactive in your online interactions."
}