Phishing Emails Evade AI Defenses with Sophisticated Obfuscation Techniques
New Phishing Tactic Employs Obfuscation Technique to Evade NLP-Based Security Defenses
A newly discovered phishing tactic is attempting to evade natural language processing (NLP) based security defenses by employing a unique obfuscation technique.
Obfuscation Technique
According to a report by KnowBe4, this method involves including typical phishing content at the beginning of an email, followed by a substantial amount of unrelated benign content at the end, after several line breaks.
Analysis of Obfuscated Emails
KnowBe4 analyzed 40 of these obfuscated emails and found that the majority used over 100 line breaks between the social-engineering content and the benign content, with an average of 157 line breaks.
This tactic reduces the likelihood of the recipient scrolling down far enough to notice the obfuscation element.
Types of Obfuscation Content
The benign content typically imitates “graymail” from legitimate companies, such as promotional emails sent to customers in bulk.
In one example, an email imitating an Adobe Acrobat file share from a target’s HR department contained an Uber advertisement at the bottom.
This type of graymail-style obfuscation content was observed in approximately 63% of the cases analyzed.
The most common obfuscation element used was a Bank of America signature, which also served to pad the email with legitimate links, such as “uber.com” or “bofa.com”.
On average, the emails contained about 5 legitimate links compared to 2 malicious links.
Impact on Security Tools
In addition to adding benign noise to malicious emails to confuse NLP scanners, this obfuscation technique also significantly increases the overall length of the email.
This can cause security tools to timeout during the scanning process, allowing phishing emails to bypass detection.
Polymorphic Phishing Campaigns
KnowBe4 also discovered that one of the phishing campaigns using this technique employed randomized subject lines and attachment names for each recipient within the victim organization.
This polymorphic element makes it more challenging for administrators to contain the attack by mass deleting emails with the same subject line or attachment name.
Effective Defenses
While NLP solutions that rely on probability scales to determine whether an email is malicious may be fooled by this technique, more advanced AI-driven solutions that measure intent could help detect these obfuscated emails.
Defenses that adopt a zero-trust approach, rather than relying on probabilities, may also be more effective at blocking these emails from inboxes.
About Author
English