Phishing emails target AI defenses with unique obfuscation

An emerging email obfuscation technique is being used in an attempt to trick natural language processing (NLP) based email defenses, KnowBe4 reported Monday.

The technique included typical phishing content at the start of an email and then a large amount of unrelated benign content at the end after several line breaks, in an attempt to “outweigh” the malicious content processed by NLP solutions, wrote KnowBe4 Threat Intelligence Lead James Dyer.

KnowBe4 analyzed 40 of these obfuscated emails and found that the majority used 100 or more line breaks between the social-engineering content and the benign content, with the average being 157 line breaks. This reduces the chance of the email recipient scrolling down enough to notice the obfuscation element.

The content found at the bottom of these emails usually imitated “graymail” from legitimate companies — non-malicious content such as promotional emails typically sent to customers in bulk. In one example, an Uber advertisement was found at the bottom of a phishing email that imitated an Adobe Acrobat file share from the target’s HR department.

This graymail-style obfuscation content was seen in about 63% of cases, with the most common obfuscation element being a Bank of America email signature. These elements also served to pad the email with legitimate links, such as “uber.com” or “bofa.com,” with the average email containing roughly 5 legitimate links compared to about 2 malicious links.

About 31% of obfuscated emails included a legitimate email chain after the malicious content, and about 6% included a large amount of randomized text. In another example shared by KnowBe4, an email that contained a malicious HTML attachment disguised as a voicemail contained benign random nonsense text — formatted as though it was an email chain — underneath the phishing content.

In addition to adding benign noise to malicious emails to confused NLP scanners, this obfuscation technique also significantly increases the overall length of the email.

“For some email security tools, if an email takes too long to scan, it will be released before the scan is complete, so phishing email[s] can get through without [being] classified as malicious,” according to KnowBe4.

KnowBe4 also found that, in one of the phishing campaigns using this technique, subject lines and attachment names were randomized for each recipient within the victim organization. This polymorphic element of the attack makes it more difficult for administrators to contain the attack by mass deleting emails with the same subject line or attachment name.

While NLP solutions that use a “probability scale” to determine whether an email is malicious may be fooled by this technique, due to a flood of benign content drowning out the malicious lures and links, KnowBe4 says more advanced AI-driven solutions that measure email intent could help detect these obfuscated emails.

Additionally, email defenses that take a zero-trust approach rather than relying on probabilities may be more effective at blocking these emails from inboxes, the company said.