Phishing sites now detect virtual machines to bypass detection


Level 83
Thread author
Top poster
Content Creator
Malware Hunter
Aug 17, 2014
Phishing sites are now using JavaScript to evade detection by checking whether a visitor is browsing the site from a virtual machine or headless device.

Cybersecurity firms commonly use headless devices or virtual machines to determine if a website is used for phishing.

To bypass detection, a phishing kit utilizes JavaScript to check whether a browser is running under a virtual machine or without an attached monitor. If it discovers any signs of analysis attempts, it shows a blank page instead of displaying the phishing page.

Discovered by MalwareHunterTeam, the script checks the visitor's screen's width and height and uses the WebGL API to query the rendering engine used by the browser. [...]
Fabian Wosar, CTO of cybersecurity firm Emsisoft, told BleepingComputer that security software utilize a variety of methods to scan for and detect phishing sites. These include signature matching and visual machine using machine learning.

"Code like the one above actually will work for some of these techniques. However, it is also trivial to prevent by just hooking a couple of JavaScript APIs and providing "fake" information," Wosar explained.