Developing Robust Evasion Techniques in Phishing Campaigns

In phishing campaigns, evasion is not just a strategy; it’s a necessity for success. A robust evasion technique can be the difference between a compromised system and a failed attempt. Attackers aim to bypass security controls such as spam filters, URL reputation checks, and even user awareness cues. The goal is to make the phishing attempt appear legitimate, which increases the likelihood of a target interacting with the payload. After reading this article, you’ll gain insights into how evasion tactics can be applied to fundamentally increase the stealth and effectiveness of phishing campaigns.

To stand out in the realm of phishing, it’s crucial to employ techniques that go undetected by sophisticated security systems. This involves creating phishing emails that look authentic and pass through technical defenses such as SPF/DKIM/DMARC validations and URL scanners. You will also learn how to obfuscate payloads to evade antivirus detection. With these skills, you’ll be capable of conducting phishing engagements that closely mimic the efforts of genuine threat actors, exposing weaknesses in human defenses before they are exploited.

Prerequisites and Setup

Setting up a successful evasion tactic begins with understanding the tools and environment required. First, make sure to have an environment where you can freely test phishing campaigns. This typically involves the use of a virtual private server (VPS) that can host phishing materials without risking your infrastructure being compromised or blacklisted. For this, you might use services like DigitalOcean or AWS.

For email crafting and sending, an open-source phishing framework like GoPhish is essential. Ensure you have GoPhish installed and configured on your VPS. The command to run GoPhish is straightforward:


gophish --config=/path/to/config.json

Run GoPhish with a specific configuration file, setting SMTP parameters and web server settings.

Next, you need to configure your email server to bypass SPF, DKIM, and DMARC checks. This involves setting up an SMTP relay that has a good reputation score. Ensure that your DNS configuration for outgoing emails correctly handles SPF (Sender Policy Framework) records. For example:


v=spf1 include:_spf.google.com ~all

SPF record allowing Google servers to send on behalf of your domain.

You’ll also need to have phishing URL hosting. This might be done through compromised websites or URL shorteners that hide the true destination. Tools such as Evilginx2 for proxying login sessions are invaluable here because they allow for more sophisticated man-in-the-middle attacks.

Step-by-Step Execution

Crafting Phishing Emails

Your phishing email must appear authentic. Use subject lines and senders that mimic legitimate internal communications or popular service providers. For instance, a plausible subject line could be: “Important: Action Required for Account Verification”. Your sender’s email might be adjusted using IDN homographs or domains that closely resemble the real ones, like new-updates@micròsoft-policy.com.

Subject: Important: Action Required for Account Verification

From: notifications@payment-intl.com

To: john.doe@company.com

Dear John,

We detected unusual activity in your account. Please verify your account to prevent suspension by clicking on the link below.

<a href='http://secure-login.microsoft.support.admin.evvv.com'>Verify Now</a>

Thank you,

Microsoft Support Team

This email mimics a security alert requiring the recipient to click a crafted link pointing to an attack-controlled domain.

URL Reputation Bypass

The use of subdomains and URL shorteners can effectively bypass URL reputation checks. By crafting URLs that incorporate recognizable domain names, but leading to a hostile endpoint, you can significantly reduce initial suspicion. An example of this technique would be:


http://account-update.google.com.fraudulent-service-directory.info

This URL blends known brand domains with a legitimate-looking but deceptive URL structure.

Another trick involves encodings or modifications using URL shorteners. For instance, you could convert the phishing URL into a tinyurl or bitly link, which makes it more challenging for reputation services to track and block effectively. This technique functions best when combined with social engineering elements, encouraging users to “download their secure report” or “verify their transaction”.

Payload Obfuscation Strategies

To evade antivirus systems, payloads can be obfuscated through custom encryptors or packers. Using tools that split or modify payload signatures can assist in AV evasion. For instance, tools like Shellter allow on-the-fly shellcode injection into native Windows applications, which can help the payload appear as routine system traffic.


shellter -a -f your-malware.exe -i quiet -o obfuscated-malware.exe

The above command uses Shellter to inject shellcode into an executable, significantly reducing its detection rate.

Another technique includes renaming or recompiling executables with less common signatures or using modified versions of known exploits to change their footprint. Run the obfuscator within a disposable virtual machine or sandbox to test its effectiveness against a suite of AV products before use.

Advanced Variations

For more advanced evasion techniques, consider using code injection into whitelisted processes. By targeting processes that are already trusted by the system, the injected code can operate without raising alarms. This often requires customizing payloads to avoid typical detection patterns.

Another powerful approach involves time-based evasion tactics. By delaying the execution of a payload until a specific time or system trigger, detection can be reduced, as the behavior appears more aligned with legitimate system operations:


Create object Wscript shell

Execute= Wscript.Sleep(60000) ' Delay execution for one minute

Execute Run "C:\Windows\System32\notepad.exe"

Execute Timeout=250

This script introduces a delay in execution, mimicking normal computing behavior.

Utilizing steganography to hide code within image files is another advanced tactic. By embedding malicious scripts into image metadata or unused file blocks, you can bypass conventional file checks that do not thoroughly inspect these elements. It requires a more complex setup, but can be highly effective if targeted correctly.

Good / Better / Best

Good

Utilizing basic domain spoofing techniques and common phishing aesthetics achieves a basic level of evasion. A basic attempt could involve simple typosquatting which, while essential, often gets caught by alert security teams. An example:


http://update-ms-accounts.com

This might fool users but is entirely visible to automated scanners and vigilant users.

Better

Incorporating subtle manipulations in email headers, and advanced URL structures improves stealth. Employing compromised domains to add legitimacy to the fraudulent emails adds another layer. For example:


Received: from email-service.domain-narrowly-associated.com by targeted-company.com

This header manipulation helps bypass stricter email server policies.

Best

Engaging a multi-layered attack with dynamic content and policed domain similarities is ideal. Modifying sender’s identity using a legitimate external service trivially associated with the actual sender increases credibility:


http://micosoft-support.it10.net/mail-redirect?src=http://user-login.micròsoft.com

This sophisticated scam looks like an internal redirect, successfully masking its malicious intent.

Related Concepts

Understanding related concepts like social engineering and technical exploitation further enhances an evasion strategy. Social engineering works hand in hand with technical evasion by manipulating targeted user behavior to achieve the desired action (clicking a link, opening a file). Technical exploitation involves breaching security protocols through overlooked vulnerabilities in systems and applications. By mastering both, you build a more comprehensive approach to compromising human and system defenses.