Full Report
A new JavaScript obfuscation method utilizing invisible Unicode characters to represent binary values is being actively abused in phishing attacks targeting affiliates of an American political action committee (PAC). [...]
Analysis Summary
# Tool/Technique: Invisible Unicode Obfuscation for JavaScript Payloads
## Overview
This technique involves hiding malicious JavaScript code within what appears to be blank space in a script file by replacing ASCII characters with specific, visually invisible Unicode characters, primarily Hangul filler characters (U+FFA0 and U+3164). This allows the malicious payload to evade simple detection by making the code appear empty or benign.
## Technical Details
- Type: Technique (Obfuscation)
- Platform: Web/JavaScript (client-side execution)
- Capabilities: Hides large payloads within seemingly empty strings or object properties, evades static analysis/scanners looking for visible code patterns.
- First Seen: October 2024 (as weaponized in actual attacks).
## MITRE ATT&CK Mapping
- T1027 - Obfuscated Files or Information
- T1027.006 - Unicode Encoding
- T1566 - Phishing
- T1566.001 - Spearphishing Attachment (if delivered via attachment) / T1566.002 - Spearphishing Link (if delivered via link)
## Functionality
### Core Capabilities
- **Encoding:** Converts the original JavaScript payload into its 8-bit binary representation (ones and zeros).
- **Substitution:** Replaces the binary digits with the invisible Unicode characters Hangul Half-Width (U+FFA0) and Hangul Full-Width (U+3164).
- **Injection:** Stores the resulting obfuscated characters as a property value within a JavaScript object.
- **Retrieval:** Utilizes a JavaScript `Proxy` with a `get()` trap to intercept access to the hidden property, converting the invisible characters back into binary and reconstructing the original JavaScript code upon execution.
### Advanced Features
- **Base64 Encoding:** The reconstructed sequence of Hangul filler characters is often further encoded using Base64 for additional concealment.
- **Anti-Analysis Checks:** Includes code designed to invoke a debugger breakpoint if analysis environments are detected, or checks for execution delay, aborting the attack and redirecting to a benign website if suspicious activity is found.
## Indicators of Compromise
- File Hashes: N/A (Technique, not a specific file)
- File Names: N/A (Injected into existing or downloaded scripts)
- Registry Keys: N/A
- Network Indicators: Domains previously linked to the **Tycoon 2FA phishing kit** were observed in association with campaigns using this method.
- Behavioral Indicators: Execution of JavaScript that utilizes `Proxy` objects to dynamically decode hidden strings upon property access, followed by immediate anti-debugging checks or redirection upon failure to meet execution criteria.
## Associated Threat Actors
- Initial reporting links this technique to attacks that also used domains previously associated with the **Tycoon 2FA phishing kit**. (Specific actor names not provided in the context).
## Detection Methods
- Signature-based detection: Difficult due to the code appearing as whitespace/filler characters.
- Behavioral detection: Monitoring for JavaScript execution that involves dynamically creating or accessing object properties through `Proxy` `get()` traps, especially when combined with Base64 decoding routines or known anti-debugging logic.
- YARA rules: Potentially developing rules to search for sequences of U+FFA0 and U+3164 characters within script content, even if appearing as blank space, followed by attempts to de-obfuscate or execute reflected code.
## Mitigation Strategies
- **Email Filtering/Sandboxing:** Enhance mail gateways to deeply inspect and sandbox embedded scripts or attached HTML files, executing them in controlled environments to observe de-obfuscation behavior.
- **Content Security Policy (CSP):** Implement strict CSP headers to restrict inline script execution or loading remote scripts from untrusted sources.
- **Endpoint Analysis:** Utilize endpoint detection and response (EDR) tools capable of monitoring runtime modification of objects and the use of JavaScript Proxies for unexpected data reconstruction.
- **User Training:** Continue training users to recognize sophisticated phishing lures, as this technique is used in conjunction with social engineering.
## Related Tools/Techniques
- **Tycoon 2FA Phishing Kit:** Domains associated with this kit were used in campaigns employing this obfuscation method.
- General JavaScript Obfuscation techniques (e.g., string concatenation, hex encoding, control-flow flattening).