Wednesday, May 29, 2024

Attackers Using Image Inversion Technique to Bypass Office 365 Filtering Mechanism

A creative Office 365 phishing campaign was discovered by WMC Global Analysis researchers that a legitimate login page of a Microsoft Account, but uses color inversion to avoid matching patterns from image recognition software, according to Kim Komando.

“As image recognition software is improving and becoming more accurate, this new technique aims to mislead scanning engines by inverting the colors of the image, causing the image hash to differ from the original.”, WMC Global explains.

This method can hinder the software’s ability to flag this image altogether (as shown in the images below).

Phishing page image

A victim visiting the website would likely recognize that the inverted picture is illegitimate and exit the website. Nevertheless, the threat actor has stored the inverted image and, within the index.php code, has used a CSS method to revert the color of the image to its original state.

Inverted image and Original comparison

Threat actors constantly plan to bypass detection, and that they can fool scanning engines by inverting or altering recognizable logos and pictures. This approach leads to the ultimate website’s appearing legitimate to users who visit, while crawlers and scanning engines are highly doubtful to detect the image as being an inverted copy of the Office365 background.

Tips to avoid getting tricked

  • Avoid opening emails from unknown senders and always check the URLs and sender fields closely. 
  • Avoid clicking on links inside emails. 
  • Use strong passwords without including personal information or common words. 
  • Use a strong antivirus with a proven detection rate against phishing attacks

As realistic as these phishing sites look, they tend to appear in places they have no business, like through random email links or pop-up ads. If you stay cautious and avoid sharing your login carelessly, your account is going to be safe. 

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

Hackers Using COVID-19 Training Lure to Attack Office 365 Users

Hackers Would Bypass Multi-Factor Authentication to Gain Full Access to Microsoft 365 Services

Website

Latest articles

Researchers Exploited Nexus Repository Using Directory Traversal Vulnerability

Hackers target and exploit GitHub repositories for a multitude of reasons and illicit purposes.The...

DDNS Service In Fortinet Or QNAP Embedded Devices Exposes Sensitive Data, Researchers Warn

Hackers employ DNS for various purposes like redirecting traffic to enable man-in-the-middle attacks, infecting...

PoC Exploit Released For macOS Privilege Escalation Vulnerability

A new vulnerability has been discovered in macOS Sonoma that is associated with privilege...

CatDDoS Exploiting 80+ Vulnerabilities, Attacking 300+ Targets Daily

Malicious traffic floods targeted systems, servers, or networks in Distributed Denial of Service (DDoS)...

GNOME Remote Desktop Vulnerability Let Attackers Read Login Credentials

GNOME desktop manager was equipped with a new feature which allowed remote users to...

Kesakode: A Remote Hash Lookup Service To Identify Malware Samples

Today marks a significant milestone for Malcat users with the release of version 0.9.6,...

Cisco Firepower Vulnerability Let Attackers Launch SQL Injection Attacks

 A critical vulnerability has been identified in Cisco Firepower Management Center (FMC) Software's web-based...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles