The Security Threat Outlook: Unraveling the Hackers’ Tactic of Fake AV Scans

ZeroFont Phishing Technique Used to Trick Outlook Users

Threat actors have recently adopted a novel approach to phishing by utilizing the existing technique of zero-point font obfuscation. This technique tricks Microsoft Outlook users into believing that phishing emails have successfully undergone antivirus scans, increasing the likelihood of recipients falling for scams. SANS Internet Storm Center analyst, Jan Kopriva, discovered a phishing email that employed this zero-font technique in a unique way. The malicious actors used it not only to evade automated email scanning systems, but also to make the email appear more trustworthy to recipients.

The ZeroFont Technique and its Deceptive Nature

Embedding text with a zero font size has long been utilized by attackers to break up visible text and make it harder for automated scanners to detect suspicious messages. However, the recent observation by Kopriva revealed that the zero-font technique was used with a different objective. Instead of hindering automated scanners, the aim was to manipulate the text displayed in the listing pane of Outlook, which appears to the left, adjacent to the message body. This section typically displays the email subject line and the beginning of the message text, providing users with clues about the email’s content.

In the phishing email analyzed by Kopriva, the attackers included text indicating that the message had been scanned and secured by a threat protection service, using a zero font size. This text appeared below the subject line in the listing pane, before the actual first line of the phishing email message displayed on the right-hand side of the screen. By doing so, the attackers created an illusion of the message being verified and secure.

Exploiting an Outlook User Interface Characteristic

Kopriva explained that the technique used by attackers exploits a characteristic of how Outlook displays email message text. It seems that Outlook, and potentially other mail user agents, display any text present at the beginning of a message in the listing view, even if it has a zero font size. This loophole allows attackers to abuse this behavior and deceive recipients by displaying fake verification messages in the listing pane.

Emerging Techniques in Phishing Scams

The zero-font technique, along with other evasive strategies such as using tiny-sized text in the zero- or one-point font range (also known as the “One Font” technique), highlights the increasing sophistication of phishing scams. These techniques disrupt email-scanning systems that rely on semantic analysis, creating confusion while remaining undetected by recipients due to the tiny font size.

Guarding Against ZeroFont Phishing Attacks

As defenders against these phishing campaigns, it is crucial to remain aware of evolving tactics employed by threat actors. Organizations conducting security awareness courses should inform employees about the zero-font phishing technique to enhance their ability to detect fraudulent messages that utilize this method. By educating employees about the various techniques used by attackers, organizations can empower their workforce to become the first line of defense against phishing scams.

The Importance of Vigilance and Keeping Security Measures Up-to-Date

While this specific zero-font technique has recently gained attention, it is possible that attackers have already been utilizing it for some time. Cybersecurity professionals and individuals alike need to be vigilant and stay informed about emerging threats. It is crucial for organizations to implement robust security measures, including up-to-date email scanning systems, to identify and block such attacks.

Furthermore, organizations should regularly update security training programs to educate employees about the latest phishing techniques and how to recognize and report suspicious emails. By combining technological defenses with a well-informed and trained workforce, organizations can significantly reduce the risk of falling victim to phishing scams.

Conclusion

The zero-font phishing technique, which utilizes the manipulation of font size to deceive Outlook users, represents a concerning evolution in phishing scams. With attackers continuously refining their tactics, it is imperative for organizations and individuals to stay informed and take proactive steps to enhance their defenses against such threats. By leveraging security awareness training and maintaining robust security measures, we can collectively combat phishing attacks and protect sensitive information.