What is Static Code Injection in Phishing?

Static code injection involves embedding malicious code directly into a file or web page so that it performs unauthorized actions when accessed, commonly used in phishing to exploit client-side vulnerabilities.

Static code injection is the embedding of malicious script into seemingly benign files or web pages, triggering execution upon interaction.

Why It Matters

In phishing and social engineering, static code injection is especially potent because it doesn’t rely on dynamic factors like server-side interactions post-delivery. Once the malicious code is embedded, the file or page doesn’t change, increasing its chance of bypassing simple file integrity checks or server-side defenses. For the phishing operator, this technique allows them to craft emails, documents, or web pages that seem legitimate until the malicious code executes when viewed by the target.

For both an operator crafting a phishing campaign and a target encountering it, the significant threat of static code injection lies in its subtlety and persistence. Injected code can remain dormant until the moment of interaction, making it difficult to detect through superficial examination. This quality enables sophisticated phishing schemes where additional payloads are downloaded, credentials are captured, or further unauthorized actions are executed without raising immediate suspicion.

In Practice

One realistic example of static code injection is embedding JavaScript into a PDF. A phishing email might arrive with the subject line “Invoice Receipt – Review Required” from a spoofed sender like billing@trustedsupplier.com. The attached PDF, when opened, silently executes a script to collect browser data or inject another payload without the user being aware.


Subject: Invoice Receipt – Review Required

From: billing@trustedsupplier.com



Dear Customer,



Please find attached your invoice for recent services. Kindly review it at your earliest convenience.



Best regards,

The Trusted Supplier Team



Attachment: Invoice_August2023.pdf

Another scenario involves HTML emails containing inline JavaScript. The email may appear as an innocuous notification with a subject like “New Message from HR – Click to Read.” When the HTML email is opened, the injected static code could redirect the recipient to a phishing page that mimics a legitimate login portal, which then harvests credentials.

Furthermore, static injection can affect web pages, where malicious code is embedded directly into the page’s source. For example, a phishing site masquerading as a login page might use a script hidden within its HTML to capture users’ keystrokes as they enter credentials.

Related Terms

To fully understand static code injection, it’s useful to explore adjacent concepts such as cross-site scripting (XSS), where attackers inject code into users’ browsers via web applications. Another related term is SQL injection, which involves inserting malicious SQL statements into an input field to exploit database vulnerabilities.

References

CISA’s Known Exploited Vulnerabilities Catalog

OWASP – Static Code Injection