The blurred images are taken from legitimate websites such as: In some cases, the email address is prefilled.Īttackers commonly use JavaScript in the SHTML attachments that will be used either to generate the malicious phishing form or to redirect or to hide malicious URLs and behavior.īelow is the code snippet that shows how the blurred background image is loaded. To read the document, however, the user must enter his/her credentials. When the SHTML attachment is clicked, it opens a blurred fake document with a login page in the browser as shown in Figure 3. The sentiments used in such phishing emails include a payment confirmation, invoice, shipment etc., The email contains a small thread of messages to make the recipient more curious to open the attachment. McAfee Client Detection of SHTMLĪttackers victimize users by distributing SHTML files as email attachments. shows the geological distribution of McAfee clients who detect malicious SHTML files.įigure 1. The SHTML files are commonly associated with web servers redirecting users to malicious, credential-stealing websites or display phishing forms locally within the browser to harvest user-sensitive information.įigure 1. In this wave, the attacker has been abusing server-parsed HTML (SHTML) files. McAfee Labs has recently observed a new wave of phishing attacks.
0 Comments
Leave a Reply. |