JavaScript Spots Virtual Machines on Phishing Sites

The MalwareHunter Team has discovered a new trick being leveraged by Phishing websites.

According to a recent tweet, attackers are using a JavaScript…er…script that allows malicious phishing websites to detect Virtual Machines that are poking around their ponds.

I promise, that’s the last joke about fish.

Anyways, the “trick” uses the WebGL API to decipher the rendering engine used by the browser visiting their site.

If the WebGL API detects the visitor is using a software renderer (like SwiftShader, LLVMpipe or Virtual Box)), which are commonly used by virtual machines, it’ll start a process that blocks the VM from viewing its content.

If it detects that (and a few other conditions like detecting color depth that’s less than 24-bit or a screen height less than 100 pixels) the website won’t display.

It looks like the exploit is based on this article from bannedit.github.io which describes Java’s ability to detect virtual machines.

It’s not uncommon that security researches find the need to strengthen their virtual machines to avoid malware detection and it looks like now they’ll have to strengthen themselves against phishing attacks too.

Until you can do that, I suggest you read our Phishing prevention guide here: https://www.security7.net/guide/social-engineering/what-is-a-phishing-attack

Like our blog? Subscribe using the CTA in the upper right-hand corner of this page. Feel like sharing your thoughts with us? Use the comment section below.