April 9, 2019 By David Bisson 2 min read

In a recent phishing campaign, fraudsters used a legitimate browser extension tool called SingleFile to obfuscate their attacks and remain undetected.

According to Trend Micro, the malicious mail campaign started on Feb. 27 and utilized SingleFile, a web extension for Google Chrome and Mozilla Firefox that allows users to save webpages as single HTML files. As such, SingleFile is designed to help streamline the process by which users can archive webpages.

Threat actors abused SingleFile’s legitimate functionality, however, by copying the login pages of legitimate webpages, such as those of the payment processing website Stripe. Though simple, this spoofing method enabled the attackers to generate almost an identical copy of the legitimate website’s login mechanism, which they could then use to phish for users’ credentials. This attack technique came with an added bonus in that it hid the login form’s HTML code as well as the JavaScript used by the legitimate login page from detection by static security tools.

Attackers’ Growing Abuse of Legitimate Tools

As noted by Symantec, threat actors are increasingly living off the land in that they’re using tools already installed on a computer and running simple scripts or shellcode directly into memory as part of their campaigns. As with the use of SingleFile identified above, these tactics help attackers evade detection.

Fraudsters are also now obtaining digital certificates to add a sense of legitimacy to their phishing pages. According to Krebs on Security, just under half (49 percent) of phishing sites now come with the green padlock in the address bar, an icon that is indicative of a secure web connection.

How to Defend Against SingleFile Phishing Campaigns

Security professionals can help defend their organizations against a phishing campaign by using ahead-of-threat detection to filter out potentially malicious domains based on WHOIS information and other intelligence feeds. Security teams should also develop an ongoing security awareness program and customize training to the unique needs of the organization.

More from

Poland spending $760 million on cybersecurity after attack

3 min read - Visitors to the Polish Press Agency (PAP) website on May 31 at 2 p.m. Polish time were met with an unusual message. Instead of the typical daily news, the state-run newspaper had supposedly published a story announcing that a partial mobilization, which means calling up specific people to serve in the armed forces, was ordered by Polish Prime Minister Donald Tusk beginning on July 1, 2024. Deputy Prime Minister Krzysztof Gawkowski refuted the claim on X (formerly Twitter). His post…

How generative AI Is expanding the insider threat attack surface

3 min read - As the adoption of generative AI (GenAI) soars, so too does the risk of insider threats. This puts even more pressure on businesses to rethink security and confidentiality policies.In just a few years, artificial intelligence (AI) has radically changed the world of work. 61% of knowledge workers now use GenAI tools — particularly OpenAI’s ChatGPT — in their daily routines. At the same time, business leaders, often partly driven by a fear of missing out, are investing billions in tools…

Water facilities warned to improve cybersecurity

3 min read - United States water facilities, which include 150,000 public water systems, have become an increasingly high-risk target for cyber criminals in recent years. This rising threat has demanded more attention and policies focused on improving cybersecurity.Water and wastewater systems are one of the 16 critical infrastructures in the U.S. The definition for inclusion in this category is that the industry must be so crucial to the United States that “the incapacity or destruction of such systems and assets would have a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today