Mechanisms of Evasion in Phishing Attachments: Beyond Basic Filters

In the landscape of cybersecurity, adversaries continually evolve their tactics to bypass AI-based detection and security filters. Phishing attachments have become more sophisticated, employing advanced evasion techniques designed to outsmart even the most robust defense mechanisms. This article will delve into several methods, such as comment stuffing, to illustrate how you can achieve a high-yield, realistic simulation. Understanding these tactics will allow you to craft phishing campaigns that not only test the resilience of human targets but also probe the limits of technical defenses.

Executing a believable phishing attack goes beyond creating an attachment that draws clicks. It requires embedding evasion techniques that make the attachment appear legitimate and safe. The goal is to escape both automated scrutiny and wary recipients, leading to higher rates of engagement — be that clicks, credential submission, or payload execution. After reading this article, you’ll be equipped to deploy these tactics effectively, ensuring your phishing engagements expose genuine vulnerabilities.

Prerequisites and Setup

To implement these advanced evasion techniques, you’ll need specific tools and an understanding of file formats often used in phishing attachments, like PDF or Office documents. Here’s what you need to get started:

GoPhish: A highly recommended open-source phishing framework. Installing it is straightforward and typically involves cloning the repository and running a server.
Libpoppler: This is necessary for manipulating PDF files and can be installed with package managers like apt or brew.
msfvenom: Part of the Metasploit Framework, this tool helps create payloads to embed within document files.
Example install command for

libpoppler

on Debian-based systems:


sudo apt-get install libpoppler-glib-dev

This command installs poppler libraries essential for handling and modifying PDF files.

Before beginning, ensure you have access to a controlled environment where you can send email payloads without interfering with live services. Maintaining operational security is critical to prevent premature exposure or unintentional effects outside of your controlled test scope.

Step-by-Step Execution

Embedding Evasion with Comment Stuffing

Step 1: Creating the Base Document

Start with a legitimate-looking document that contains your phishing lure. For a PDF, this might be an “Updated Employee Benefits” file. You use a tool like LibreOffice to create this document and export it as a PDF.

Step 2: Injecting HTML Comments

Insert HTML comments and random data into the PDF structure to add noise and throw off content-based filters. This technique, known as comment stuffing, bloats the file while keeping content visible to users intact.


sed -i 's/\/S \/GoToR/\/S \/GoToR % Comment to confuse filters %/' file.pdf

This command injects a benign comment into a PDF file, subtly altering it to evade filters without impacting readability or functionality for the user.

Step 3: Distortion with Base64 Encoding

Take the existing PDF elements and encode some within Base64. This obfuscates portions of the document’s content, making it appear less suspicious to automated scanners.


echo "aW5zdHJ1Y3Rpb246IGJhc2U2NCBjb250ZW50" | base64 -d > part_of_pdf.txt

Decode Base64 encoded strings into legitimate sections of a document, ensuring portions remain obfuscated to script-based inspection tools.

Leveraging Macro Tricks in Office Documents

Step 1: Crafting Macro Code

Develop a VBA script hidden within a seemingly innocuous Excel document. This script might automate system commands or deflect attention by performing innocuous tasks before executing malicious code.


Sub AutoOpen()

    Dim scaryCommand As String

    scareCommand = "cmd.exe /c echo Hello World > C:\Test\log.txt"

    Shell scaryCommand, vbHide

End Sub

This VBA macro executes a harmless command upon opening the document, illustrating execution without immediate suspicious activity.

Step 2: Hiding Payloads with Encryption

Encrypt your payload using built-in Office functions, concealing it within legitimate document features until triggered.

Encapsulation also involves using properties, like defining disguised names or embedding scripts within inactive features of the document.

Step 3: Obfuscation Through Splitting Functions

Break scripts into parts distributed across various macro modules. Each module appears independent and non-aggregated by static analysis.


Function PartA()

    ' Initial decoy function

    Return "Pa"

End Function



Function PartB()

    ' Secondary decoy function

    Return "ssword"

End Function

Combine these components dynamically when executed, allowing full scripts to manifest only during runtime.

File Format Malleability with Extension Confusion

Step 1: Embedding Executables

Use a script to disguise executables as harmless documents by altering their extensions without changing file headers.


mv malware.exe report.docx

This simple command changes the extension of an executable, disguising it as a document file.

Step 2: Utilizing MIME Type Cloaking

Modify MIME types within document headers to mismatch the displayed file format, increasing difficulty for filters identifying the true nature of the file without opening it.

Advanced Variations

Exploiting Password-Protected Files

Surpass traditional filtering by wrapping documents in password-protected layers to keep AV solutions from scanning the content. Distribute passwords through separate communications channels, like a seemingly benign email or a phone call.


zip -e phishing_doc.zip phishing_doc.docx

Create password-protected archives containing your phishing content to bypass content inspection.

Homograph Domain in Email Spoofing

Use internationalized domain names (IDNs) for emails appearing from legitimate domains, focusing on replacing or altering characters that closely resemble legitimate ones, confusing both filters and users.


From: security@mícrosoft.com

Leveraging IDNs to craft near-identical looking domains, evading both algorithmic detection and user skepticism.

Good/Better/Best

Good: Using simple obfuscation like Base64 encoding parts of your attachments. This is functional but may not fool well-configured systems.
```
printf 'Hello' | base64
```
Translated into attachment content to obscure plain text
Better: Combination of comment stuffing and micro-macro functions within documents. Enhances evasion through layered complexity.
```
Sub DummyTask()

    MsgBox "Click Next for Details"

End Sub
```
A decoy routine delaying detection while engaging targets.
Best: Embedding payloads within homographic domains and time-triggered macros in various document sections for maximized stealth.
```
Sub DelayedExecution()

    Application.OnTime Now + TimeValue("00:01:00"), "RunnablePayload"

End Sub
```
Hide execution under the guise of routine operations, spinning elaborate deceptions at the highest sophistication level.

Related Concepts

Phishing attachment evasion techniques build off many concepts integral to broader hacking frameworks. Understanding Cobalt Strike beacons and Evilginx2 proxy manipulation can deepen understanding of environmental persistence. Additionally, refining URL spoofing methods aligns with tactics like PhishTank tracking evasion, ensuring adaptability in multifunctional phishing campaigns.