New JavaScript Trick Allows Phishing Sites to Detect Virtual Machines


March 17, 2021

The MalwareHunter Team has discovered a new trick being leveraged by Phishing websites.

According to a recent tweet, attackers are using a JavaScript…er…script that allows malicious phishing websites to detect Virtual Machines that are poking around their ponds.

I promise, that’s the last joke about fish.

Anyways, the “trick” uses the WebGL API to decipher the rendering engine used by the browser visiting their site.

If the WebGL API detects the visitor is using a software renderer (like SwiftShader, LLVMpipe or Virtual Box)), which are commonly used by virtual machines, it’ll start a process that blocks the VM from viewing its content.

If it detects that (and a few other conditions like detecting color depth that’s less than 24-bit or a screen height less than 100 pixels) the website won’t display.

It looks like the exploit is based on this article from which describes Java’s ability to detect virtual machines.

It’s not uncommon that security researches find the need to strengthen their virtual machines to avoid malware detection and it looks like now they’ll have to strengthen themselves against phishing attacks too.

Until you can do that, I suggest you read our Phishing prevention guide here:

Like our blog? Subscribe using the CTA in the upper right-hand corner of this page. Feel like sharing your thoughts with us? Use the comment section below.

Carl Keyser is a Digital Marketing Specialist at Integris.

Keep reading

How the Best IT Companies in Minnesota Support the Hybrid Workforce

How the Best IT Companies in Minnesota Support the Hybrid Workforce

After the initial shutdowns and stay-at-home orders lifted following COVID-19, workers throughout the United States and Minnesota decided that the work-from-home model was here to stay. It makes sense -- working from home offers a lot of convenience to your team – and...