What is JSON in Phishing?

JSON, or JavaScript Object Notation, is a lightweight data-interchange format widely used to transmit data between a server and web application, which attackers employ in phishing to structure data, craft payloads, and interact with APIs.

Definition

JSON is a structured data format that threat actors leverage to organize and transmit data effectively during phishing campaigns.

Why It Matters

JSON is integral to modern web applications due to its simplicity and compatibility with most programming languages. This makes it exceedingly valuable for threat actors, allowing them to create sophisticated phishing payloads that can seamlessly interact with various APIs and web services to exfiltrate data or manipulate user interaction flows. As organizations increasingly utilize APIs as part of their infrastructure, threat actors exploit this reliance by crafting payloads that can easily ingest or produce JSON-encoded data.

JSON’s ubiquitous nature means it is often overlooked as a weapon in phishing attacks. Its structured format is ideal for packing and transmitting critical data, such as user credentials or session identifiers, back to an attacker-controlled server. Moreover, JSON is frequently used in crafting requests to APIs during phishing engagements, making it a crucial component in automated and human-centered attacks.

In Practice

To understand JSON’s role in phishing, consider these real-world scenarios:

A phishing email links to a fake login page mimicking a popular service. Once a user submits their credentials, the page sends a JSON payload via a POST request to an attacker-controlled server. The payload might look like:


{

   "username": "user@example.com",

   "password": "P@ssword123!"

}

This JSON data packet efficiently captures and transmits the victim’s credentials to the attacker.

In a more advanced scenario, an attacker leverages a compromised API to send phishing-related notifications. The JSON structure here would be used to craft legitimate-looking messages, embedded with phishing links.


{

   "to": "victim@example.com",

   "message": "Your account requires immediate verification. Login here: http://malicious-site.com",

   "timestamp": "2023-11-08T12:30:45Z"

}

This approach uses JSON to mimic API syntax, making the phishing attempt appear more legitimate and bypass manual scrutiny due to its structured data format.

Another common usage of JSON in phishing is for malicious configuration files where phishing kits use JSON to store key configurations and options, such as API endpoints for data exfiltration or command and control details.

Example phishing kit configuration:


{

   "apiEndpoint": "http://api.attacker-site.com/v1/data",

   "webhook": "http://webhook.site/unique-id",

   "interval": 60

}

Here, JSON informs the script how to communicate with command and control servers, automate data exfiltration tasks, and set up intervals for checking new phishing victims.

Related Terms

To fully grasp the scope of JSON’s utility in phishing, familiarize yourself with adjacent terms like API, which provide an interface for interactions that JSON often facilitates. Understanding HTTP requests is also critical as these are common conduits for JSON data in phishing. Lastly, API security can provide insights into potential vulnerabilities that phishing campaigns exploit.

References

Understanding JSON in Phishing Attacks

Official JSON Documentation