Evasion Techniques in Phishing: Comment Stuffing Explained

Phishing is continually evolving, as attackers devise new methods to bypass sophisticated detection systems. One such evasion technique making waves is comment stuffing within HTML attachments. This method primarily targets the inspection layers of an anti-phishing filter, which often relies on AI to assess message legitimacy. By embedding benign-looking text and code comments, phishers can dilute the malicious signals an AI looks for, considerably lowering the risk of detection.

Executing this technique effectively requires precision — you must balance obfuscation with the delivery of a functioning phishing payload. Done poorly, or without substantial knowledge of HTML and scripting, comment stuffing can make your campaign an instant fail as it won’t appropriately render or could prematurely trigger detection controls. This article will arm you with the understanding and execution steps needed to successfully implement comment stuffing in phishing scenarios.

By the time you finish reading, you’ll understand what makes a comment stuffing attack effective and how to construct phishing emails that can bypass modern detection systems. You’ll see specific examples of how to integrate comment stuffing into your phishing engagements and elevate your red teaming efforts to uncover critical security gaps.

Prerequisites and Setup

To engage in comment stuffing, you’ll need several prerequisites set up to ensure a smooth operation. Begin with a simple web server and a domain to host your phishing pages — these should not be connected to any production systems, as this could lead to unwanted blocking or flagging by domain reputation services.

Next, ensure you have a basic knowledge of HTML and JavaScript or have access to a developer who can handle this aspect. You’ll use an HTML editor like Sublime Text or Visual Studio Code to craft the body of your emails and the embedded pages. Mail testing platforms such as GoPhish are essential for running simulations and ensuring deliverability and effectiveness.

Install necessary tools and environments with commands such as:


apt-get install apache2

gophish --smtp-host 0.0.0.0:25

These commands will install a basic Apache server and launch GoPhish with SMTP capabilities on a local host, allowing you to simulate and test your modified emails effectively.

The operational environment should mimic as closely as possible the real-world conditions under which these emails would be received, including configurations for SPF, DKIM, and DMARC records, allowing you to see how comment-stuffed emails are treated by modern security systems in real-time.

Step-by-Step Execution

Step 1: Crafting the Base HTML

Start by constructing the base HTML structure for your email or landing page. This is where you will eventually insert comment stuffing to obscure its purpose. Here’s an example of a basic HTML email:


<html>

<head>

  <title>Important Account Notification</title>

</head>

<body>

  <p>Dear User,</p>

  <p>Your account requires a security update. Please <a href="http://login.microsoft.com.verify-account.com/update">click here</a> to complete the process.</p>

  <p>Thank you,<br>Your IT Team</p>

</body>

</html>

This snippet forms the foundation of your phishing attempt. The goal here is to make it resemble a legitimate communication sent by the IT department. Note that the link is formatted to look official, but diverts users to a phishing page.

Step 2: Implementing Comment Stuffing

Once you have your base, you’ll begin to add benign comments throughout the HTML. The purpose of these comments is to disrupt the signature-based or heuristic detection systems without affecting the end-user’s display of the email.


<html>

<head>

  <!-- Material Design Bootstrap -->

  <title>Important Account Notification</title>

</head>

<body>

  <!-- Body starts -->

  <p>Dear User, <!-- Placeholder for user name --></p>

  <p><!-- Beginning of message -->Your account requires a security update. <!-- Continue --><a href="http://login.microsoft.com.verify-account.com/update">click here</a><!-- Call to action --> to complete the process.</p>

  <p><!-- Sign-off by compliance --><!-- IT --><br>Your IT Team<!-- /IT --></p>

</body>

<!-- Footer -->

</html>

Comments such as “” are strategically utilized to create noise that can mislead scanners, reducing their accuracy. These should be carefully inserted in various parts of the HTML code, mimicking legitimate HTML comments.

Step 3: Testing and Adjustments

After constructing your comment-stuffed HTML, perform thorough testing. Send the built email through your GoPhish server to various email clients. Check how email filters handle the message by examining delivery status, whether it lands in a spam folder, and inspect warnings, if any.


gophish send-email --list "target-list.csv" --template "html_with_comments.html"

This command launches a test campaign in GoPhish, using your crafted template. Adjust your comment use as needed based on the behavior observed. Continuous testing across multiple scenarios is key to establishing what variations of comment stuffing are most effective in different environments.

Advanced Variations

Variation 1: Dynamic Comment Insertion

In dynamic comment insertion, you combine comment stuffing with JavaScript to generate variable comments in real-time. This trick is key to bypassing AI-based detection, as the comments inserted into each email are random and therefore can’t be pegged to a fixed pattern or signature.


<script type="text/javascript">

  var startComment = "<!-- Start: " + Math.random().toString(36).substr(2, 5) + " -->";

  var endComment = "<!-- End: " + Math.random().toString(36).substr(2, 5) + " -->";

  document.write(startComment + "Security Update Required" + endComment);

</script>

This script dynamically generates a random identifier for each comment tag, increasing unpredictability and making it more difficult for filtering systems to create a reliable detection signature.

Good / Better / Best

Good: Comment stuffing with static comments in a standard HTML format. These comments make the HTML appear somewhat more complex but might fail against AI-filtering.


<!-- Simple Comment -->

<p>Your account update requires immediate attention.</p>

Better: Using more realistic comments that mimic legitimate coding practices.


<!-- Start of Message Content -->

<p>Your account update requires immediate attention.</p>

<!-- End of Message Content -->

Best: Dynamic comment content generated via JavaScript ensures that even sophisticated filtering mechanisms will struggle to identify the phishing attempt by pattern or predictability.


<script>document.write("<!-- " + Math.random().toString(36).substr(2, 5) + " " + "</p>");</script>

This tier approach shows the evolution of complexity and effectiveness in comment stuffing. Each level increases the likelihood that the phishing attempt will bypass security systems, especially those relying on AI-driven analysis.

Related Concepts

Comment stuffing isn’t the only evasion technique used by attackers. URL obfuscation methods, such as those involving Punycode or alternate TLDs, similarly aim to bypass detection mechanisms by subverting regex-based or domain reputation checks. Combining these techniques with social engineering content can vastly increase the rate of successful user interaction within a phishing campaign.