Phishing and malware techniques have been evolving since the time they were detected, conceptualized and recognized. Even though the malware payload or a phishing website URL is considered as the most important part from a detection and prevention perspective, we have observed a number of changes within the past few months in the phishing delivery mechanisms.
Our new whitepaper, “The Evolution of a Phish: Phishing Delivery Mechanisms,” covers an example of how obfuscation and file creation changes the detection process, and examines how attackers have gone from using simple malicious file uploads to more advanced techniques such as hiding a malicious file or link in plain sight.
Over the past few months, Ronnie Tokazowski has analyzed various malware campaigns that have used phising as the delivery method. The malware has evolved from attachments to links to 3rd party websites such as Dropbox. He’s also provided in-depth analysis of Dyre, which used a fax-themed phishing email similar to the one discussed in the whitepaper.
The interesting trend, however, is not that both phishing campaigns used similar themes, but the underlying methods of how attackers are trying to evade detection, and how there is no way to test the file until and unless the file gets formed in the browser. As an industry, we must acknowledge the reality of this evolution, and understand that new delivery mechanisms will continue to challenge all defense layers. This reality makes the last line of defense – employees – essential.