A basic text

Researchers at Avanan have found evidence of a phishing campaign that involves whited-out text intended to trick email security filters.

Underneath all the chatter about advanced cybercrime techniques, sometimes it’s the little things that get the job done.

Researchers at Avanan said Thursday they’ve found evidence of a phishing campaign that uses a simple trick involving the text color in an email.

It works this way: The bogus emails include text that is covered in white, “blinding it from the end-user and fooling phishing filters,” writes Avanan’s Jeremy Fuchs. It’s the latest version of what phishing campaigns do to show “the end-user one thing and the filter another.” 

In this case, the attackers add nonsense strings of text that obfuscate what otherwise looks like a typical phishing email — and probably would be exiled immediately to the trash by many email providers. The goal, as is common for this kind of campaign, is to get the recipient to log into a fake webpage or call a phone number — “a classic credential harvesting scheme,” Avanan says.

For a simple approximation of what happens in the text, highlight the next sentence with your cursor:

What you see is not what you get.

Depending on what kind of device you’re using, and what color your web browser’s highlight bar is, you might be able to see the word “not” in the spot where — to the naked eye — it looks like empty space.

Below are some screenshots from Avanan. The first email looks like a typical phishing attempt:

When the cursor is dragged over the text, though, it looks like what you see below. “Notice the random characters strung throughout,” Avanan says:

Avanan, part of cybersecurity company Check Point, notes that similar techniques in the past have included really tiny font sizes.

Ultimately, the lure is the threat of a $499.19 charge to a person’s account.

“This email takes advantage of a classic social engineering ploy – the auto-renewal,” Fuchs writes. “By sending an email with a charge of a hefty sum, it will induce some folks to click or call to rectify what seems like a fraudulent charge. The email was sent on the same day as the purported renewal, adding even more urgency.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure