Phishing sites now detect virtual machines to bypass detection

[silversurfer]

Content source

https://www.bleepingcomputer.com/news/security/phishing-sites-now-detect-virtual-machines-to-bypass-detection/

Phishing sites are now using JavaScript to evade detection by checking whether a visitor is browsing the site from a virtual machine or headless device.

Cybersecurity firms commonly use headless devices or virtual machines to determine if a website is used for phishing.

To bypass detection, a phishing kit utilizes JavaScript to check whether a browser is running under a virtual machine or without an attached monitor. If it discovers any signs of analysis attempts, it shows a blank page instead of displaying the phishing page.

Discovered by MalwareHunterTeam, the script checks the visitor's screen's width and height and uses the WebGL API to query the rendering engine used by the browser. [...]

Fabian Wosar, CTO of cybersecurity firm Emsisoft, told BleepingComputer that security software utilize a variety of methods to scan for and detect phishing sites. These include signature matching and visual machine using machine learning.

"Code like the one above actually will work for some of these techniques. However, it is also trivial to prevent by just hooking a couple of JavaScript APIs and providing "fake" information," Wosar explained.

Phishing sites now detect virtual machines to bypass detection

Phishing sites are now using JavaScript to evade detection by checking whether a visitor is browsing the site from a virtual machine or headless device.

www.bleepingcomputer.com

 

[Kongo]

What's the point of that? It doesn't matter if you enter your credentials within a virtual envornment or not. Or is it because they think that advanced people who use a Virtual Machine are too smart for such tricks?

 

[ForgottenSeer 85179]

What's the point of that? It doesn't matter if you enter your credentials within a virtual envornment or not. Or is it because they think that advanced people who use a Virtual Machine are too smart for such tricks?

You don't get the point.
It's harder now for (security-)researcher. They need non-VM systems and need to be more careful

 

[Kongo]

You don't get the point.
It's harder now for (security-)researcher. They need non-VM systems and need to be more careful