JavaScript Spots Virtual Machines on Phishing Sites


March 17, 2021

The MalwareHunter Team has discovered a new trick being leveraged by Phishing websites.

According to a recent tweet, attackers are using a JavaScript…er…script that allows malicious phishing websites to detect Virtual Machines that are poking around their ponds.

I promise, that’s the last joke about fish.

Anyways, the “trick” uses the WebGL API to decipher the rendering engine used by the browser visiting their site.

If the WebGL API detects the visitor is using a software renderer (like SwiftShader, LLVMpipe or Virtual Box)), which are commonly used by virtual machines, it’ll start a process that blocks the VM from viewing its content.

If it detects that (and a few other conditions like detecting color depth that’s less than 24-bit or a screen height less than 100 pixels) the website won’t display.

It looks like the exploit is based on this article from which describes Java’s ability to detect virtual machines.

It’s not uncommon that security researches find the need to strengthen their virtual machines to avoid malware detection and it looks like now they’ll have to strengthen themselves against phishing attacks too.

Until you can do that, I suggest you read our Phishing prevention guide here:

Like our blog? Subscribe using the CTA in the upper right-hand corner of this page. Feel like sharing your thoughts with us? Use the comment section below.

Carl Keyser is the Content Manager at Integris.

Keep reading

What to Know Before Installing Co-Pilot for Microsoft Word

What to Know Before Installing Co-Pilot for Microsoft Word

Imagine having an AI assistant that pulls from your notes, marries them to an existing document format, and writes a document for you. That's the power of Copilot for Microsoft Word, which is planned for rollout in 2024 for those who buy the Copilot M365 license....

Bridging the Gap between Automation and Innovation

Bridging the Gap between Automation and Innovation

Automation and Innovation. Some people might say those two words cancel each other out. Yet, I believe these two concepts can create capacity for each other—if your business leverages the free time automation creates to foster innovation. Automation can be...