Understanding Evasion Methods in Phishing Campaigns

In the world of phishing campaigns, evasion techniques are pivotal to maximizing success and staying under the radar. A high-yield phishing attempt isn’t just about crafting a convincing email; it requires navigating through layers of security measures designed to flag suspicious activity. This involves the meticulous application of evasion strategies that address specific detection mechanisms, making the campaign more robust and less likely to be intercepted. By the end of this article, you’ll have a clear understanding of how to apply these techniques to improve phishing campaign outcomes, avoiding the common pitfalls that lead to detection.

The evasion landscape is ever-evolving, with threat actors deploying sophisticated tactics such as SMS (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance). Effectively implementing these can make the difference between a noticeably suspicious campaign and one that blends seamlessly into genuine correspondence. The following sections will give you the insights and practical know-how to elevate your phishing simulations by incorporating these evasion techniques.

Prerequisites and Setup

Before employing evasion strategies in your phishing campaigns, setting up the appropriate tools and environment is crucial. You’ll need to work with a platform designed for phishing simulations, like GoPhish. Ensure that it is properly installed and configured to send emails through an SMTP server that supports customized headers and encryption protocols.


gophish --smtp-host 192.168.1.1 --smtp-user yourname --smtp-pass secret

This command launches GoPhish with specified SMTP settings, allowing you to tailor email sending parameters that can be manipulated for evasion purposes.

Another vital tool is domain preparation. Registering domains that closely mimic legitimate brands (like typosquatting or using characters similar to the target’s brand) can significantly minimize the chances of being flagged. Set up your SPF, DKIM, and DMARC records to align with these domains. This ensures that these domains are perceived as authentic by recipient mail servers, reducing the likelihood of being marked as spam.


v=spf1 include:_spf.google.com ~all

This SPF record ensures that emails sent from Google’s servers are considered legitimate, a simple yet effective way to decrease the chances of your phishing attempts landing in a spam folder.

Step-by-Step Execution: Bypassing Detection

Utilizing SPF/DKIM/DMARC to Avoid Spam Filters

Implementing email authentication protocols such as SPF, DKIM, and DMARC is a fundamental step in evading spam filters. Begin by configuring your domain’s DNS records. Here is a comprehensive breakdown:


v=DMARC1; p=none; rua=mailto:dmarc-reports@yourfakebrand.com; ruf=mailto:forensic-dmarc-reports@yourfakebrand.com; pct=100;

This DMARC record aids in reporting any inconsistencies in email sending practices, allowing for adjustments to be made for improved delivery outcomes.

This configuration helps avoid detection by aligning email sending practices with the domain’s policies. It’s crucial to remember that legitimate SPF, DKIM, and DMARC checks can significantly enhance the perceived validity of your misleading emails.

Crafting Believable Content and Subject Lines

The body and subject of your emails should be constructed to mimic genuine communication patterns closely. This includes using language typical of internal communications or common service notifications.


Subject: Important: Action Required to Confirm Your Account Security

This subject line is designed to prompt immediate attention without raising suspicion, leveraging terms like “security” and “action required,” which create urgency.

Ensure that the email content reflects the organization’s communication style, including the use of logos, colors, and tone. An email mimicking a security notice might read:


Dear [Employee Name], 



Our records indicate that there were recent login attempts to your account that need verification. Please log in to confirm your account activity: [malicious link]



Thank you,

The IT Security Team

Aligning your lures closely with regular organizational communications makes them more convincing and less likely to trigger suspicion.

Employing Cloaking Techniques for URLs

A critical technique in evasion is carefully crafting URLs that appear legitimate yet lead the target to a controlled environment. This involves using subdomain abuse or leveraging homograph techniques to replace characters such that they visually replicate legitimate domains.


https://login.microsoft.com.verify-session.websafetynotice.com

This pattern illustrates how legitimate-looking domains obfuscate fraudulent endpoints, enhancing the chance of successful credential harvesting.

Use redirection tactics judiciously. A three-step redirection can lessen suspicion as it mimics genuine email links leading to internal company portals.

Advanced Variations

Youth Substitution and Homograph Attacks

One advanced method is utilizing homograph attacks with IDNs (Internationalized Domain Names). This entails registering domains with characters that look identical in different character sets, making detection harder for both human eyes and automated systems.


https://míсrosoft.com/login

This domain uses Cyrillic equivalents that appear visually indistinguishable from their Latin counterparts, a technique that greatly enhances the credibility of phishing attempts.

Dynamic URL Generation

Automating URL creation for each email sent not only varies the campaign but also makes static block listing less effective. By assigning unique URLs per recipient, you can evade systemic detection mechanisms.


$url = "https://auth." . uniqid() . ".securityupdate.com";

Here, the script generates a new URL for each user, complicating efforts to blacklist malicious links by standard detection systems.

Good / Better / Best

Good: Basic domain purchase with no customization can provide some phishing success but is likely to be caught by automated filters due to plain patterns and non-authenticated config.


v=spf1 -all

This minimal SPF record fails to sufficiently cover legitimate senders, resulting in high spam rejection rates.

Better: Properly configured SPF/DKIM/DMARC to a relevant spoofed brand’s domain gives a more respectable appearance, but when poorly matched to domain material, discerning users might notice.


v=spf1 ip4:11.22.33.44 include:_spf.targetcompany.com -all

Leverages a legitimate brand in SPF to ease through checks, minimizing filtration but requiring more effort than basic.

Best: Using IDN variations combined with dynamic URLs and individual email cloaking, matching subject and tone precisely to standard communications, yields undetectable campaigns that even seasoned operators might not discern.


Subject: [Urgent] Verify Your Account Access - Action Needed

This subject precisely leverages subtle urgency and credible concern, integrating smoothly into regular work dynamics.

Related Concepts

While evasion techniques offer considerable advantages, understanding their relationship with other phishing strategies is essential. Concepts like identity deception, which involves pretending to be a known contact within the organization, and banner-click entrapment, which uses banner ads to mislead users, extend the possibilities and intricacies of effective phishing campaigns. Integrating these can amplify the potential of existing methods.