Comment Stuffing Technique in Phishing: Advanced Evasion Recorded

In recent phishing campaigns, threat actors have demonstrated a high degree of adaptability by employing comment stuffing as an evasion technique. This tactic involves inserting excessive HTML comments in phishing emails to confuse AI-based filters. The deployment has been documented as part of an effort to evade detection and compromise targets through seemingly benign emails.

Campaign or TTP Overview

The technique was notably observed in a campaign where attackers targeted organizations using HTML attachments embedded within phishing emails. First detected in late 2023, this method appeals to attackers due to its ability to circumvent sophisticated detection systems that rely on pattern recognition and machine learning.

These campaigns were primarily reported targeting sectors in finance, healthcare, and enterprise services. They leveraged the inherent adaptability of email clients to process and render HTML content while the comment stuffing obfuscated the malicious intent from many filtering algorithms. This approach capitalizes on the perception that filters still face challenges in processing complex, non-linear code arrays like those generated with comment stuffing.

The methodology was reported by SANS Internet Storm Center, highlighting its role in bypassing security measures that traditionally protect against phishing attempts.

How It Was Built

The attackers constructed their campaign with deliberate precision, capitalizing on the weaknesses inherent in current AI-based detection mechanisms. Infrastructure setup included the use of phishing domains closely resembling legitimate services, such as “service-confirmation-alerts.com” and “payment-billing-info.net”. These were paired with SMTP servers situated in regions with lax data protection laws to reduce takedown risks.

The phishing emails were embedded with HTML attachments designed to simulate login portals of commonly used services like Office 365 and Google Workspace. A key aspect of these attachments was the inclusion of massive blocks of HTML comments, like so:


<!-- long sequence of seemingly benign text and HTML comments, obscuring malicious elements -->

The emails themselves employed convincing subject lines, such as “Critical: Verify Your Payment Details” and “Action Required: Service Suspension Imminent”, alongside spoofed sender addresses like “noreply@secure-payments.com”. Upon interacting with the attachments, users encountered meticulously crafted counterfeit login pages designed to capture credentials.

Why It Worked

This attack was effective for several reasons. Primarily, the tactic of HTML comment stuffing subverted AI filters that might otherwise detect suspicious patterns. The excessive commenting diverted attention from the malicious segments of the HTML file, allowing it to pass through filters that were not trained to parse such noise effectively.

Additionally, the use of realistically spoofed domains and legitimate-looking sender names played into end-user trust, increasing the likelihood of interaction. The credibility of the sender was paramount, with addresses configured to resemble communications from recognized service providers, thus blending authenticity with the urgency conveyed in subject lines.

Operator Takeaways

For red teamers, this campaign demonstrates the importance of evolving and adapting phishing tactics to mirror threat actor innovations. The deployment of comment stuffing serves as an example of obfuscating payloads in a manner that modern detection algorithms struggle to interpret accurately.

By adopting similar tactics, testing teams can assess how current email security solutions hold up against advanced evasion methods. Understanding the depth and detail that went into constructing realistic sender identities and domains can inform more comprehensive simulation practices.

Do’s and Don’ts

Do ensure realism in domain spoofing — trifling errors can betray authenticity.
Do use contemporary AI evasion tactics like comment stuffing to render attachment analysis futile.
Don’t neglect the user interface of your payloads — attention to detail in login page aesthetics will enhance the believability of your campaign.
Don’t overuse technical complexities in HTML that could trigger simple text analysis methods that might interpret large amounts of comments as suspicious.

References

Discover more about these tactics at SANS Internet Storm Center and explore the insights from their recent findings.