Phishing sites now detect virtual machines to bypass detection

Phishing sites are now using JavaScript to evade detection by checking whether a visitor is browsing the site from a virtual machine or headless device.

 Cybersecurity firms commonly use headless devices or virtual machines to determine if a website is used for phishing.

To bypass detection, a phishing kit utilizes JavaScript to check whether a browser is running under a virtual machine or without an attached monitor. If it discovers any signs of analysis attempts, it shows a blank page instead of displaying the phishing page.

Discovered by MalwareHunterTeam, the script checks the visitor's screen's width and height and uses the WebGL API to query the rendering engine used by the browser.

When performing the checks, the script will first see if the browser uses a software renderer, such as SwiftShader, LLVMpipe, or VirtualBox. Software renderers commonly indicate that the browser is running within a virtual machine.

The script also checks if the visitor's screen has a color depth of less than 24-bits or if the screen height and width are less than 100 pixels, as shown below.

If it detects any of these conditions, the phishing page will display a message in the browser's developer console and show an empty page to the visitor.

However, if the browser uses a regular hardware rendering engine and a standard screen size, the script will display the phishing landing page.

The code used by this threat actor appears to have been taken from a 2019 article describing how JavaScript can be used to detect virtual machines.

Fabian Wosar, CTO of cybersecurity firm Emsisoft, told BleepingComputer that security software utilize a variety of methods to scan for and detect phishing sites. These include signature matching and visual machine using machine learning.

"Code like the one above actually will work for some of these techniques. However, it is also trivial to prevent by just hooking a couple of JavaScript APIs and providing "fake" information," Wosar explained.

As it's common for researchers and security companies to harden their virtual machines to evade detection by malware, it appears they will now also have to harden them against phishing attacks.

As a way to see what renderer and screen information is reported by your browser, BleepingComputer has created a test page that you can use.