Hands off my creds: phishing tools vs phishing defenses

Hands off my creds: phishing tools vs phishing defenses

Speakers: Jacob Torrey, Canary

Conference: CHCon

YouTube: https://www.youtube.com/watch?v=y8-VL2OdQcY

Overview

In his CHCon talk, "Hands off my creds: phishing tools vs phishing defenses," Jacob Torrey from Canary delivers a compelling and detailed exposition on the relentless cat-and-mouse game between sophisticated phishing attack techniques and the defenses designed to thwart them. Torrey highlights that despite advancements in security, phishing remains the number one initial access vector for modern breaches, constantly evolving beyond simple email attachments to highly technical, multi-stage attacks that can bypass most forms of multi-factor authentication (MFA).

The core of Torrey's presentation emphasizes the dynamic nature of this cyber conflict, illustrating how new attack methods are rapidly developed, shared within the attacker community, and then swiftly countered by defenders, only for new bypasses to emerge. He meticulously dissects various modern phishing frameworks, particularly focusing on Adversary-in-the-Middle (AiTM) techniques, and contrasts them with traditional MFA solutions, revealing their inherent vulnerabilities. The talk culminates in a strong call to action for organizations to adopt truly phishing-resistant authentication methods, such as device-bound passkeys, which he posits as the only current "silver bullet" against these pervasive threats.

This talk is crucial for security professionals, incident responders, and anyone involved in identity and access management. It provides an essential understanding of the current threat landscape, demystifies complex phishing methodologies, and offers practical defensive strategies. Torrey's insights not only expose the sophisticated tactics employed by adversaries but also underscore the critical need for continuous adaptation and a proactive stance in safeguarding digital identities, particularly in the context of outsourced cloud services where visibility can be limited.

Background

▶ Watch: Introduction and the 'silver bullet' of passkeys (0:00)

The evolution of phishing attacks traces a fascinating, if alarming, trajectory from rudimentary social engineering to highly automated and technically sophisticated operations. Jacob Torrey begins by recalling the early days of phishing, often associated with simple malware dissemination through attachments like the infamous "Love Bug" in the late 1990s. These attacks relied on basic user trust and a lack of endpoint protection, often leading to the execution of malicious code directly on the victim's machine.

The early 2000s saw the emergence of rudimentary credential harvesting, exemplified by scams targeting platforms like E-gold after the 9/11 attacks in 2001 (referring to the event, not the year, with a clarification that there's "one every year but the one I'm talking about happened in 2011" for the ID verification aspect). These attacks involved directing users to static, mirrored websites (often created with wget) that mimicked legitimate login pages. At this stage, a lack of SSL/TLS certificates on phishing sites was common, as obtaining them was expensive and complex. However, as Torrey notes, this landscape has drastically changed, with attackers now routinely deploying SSL to lend an air of legitimacy.

A significant shift occurred with the rise of spear phishing, which gained prominence with incidents like the 2011 RSA compromise. This involved highly targeted attacks, where specific individuals were identified and lured into running malware or divulging credentials through tailored communications, often leveraging personal or professional context (e.g., "hiring information or his bonus"). This marked a move towards more deliberate and impactful attacks, recognizing the value of specific targets within an organization.

In the modern era, phishing has transitioned almost entirely from malware dissemination to credential harvesting, driven by the consolidation of digital identities. Centralized Identity Providers (IDPs) like Okta, Microsoft Entra ID (formerly Azure AD), and Google Workspace have become prime targets. Compromising a single IDP account can grant attackers access to a vast array of interconnected services, making these platforms highly attractive.

The proliferation of phishing kits has dramatically lowered the barrier to entry for attackers. These kits are often "super devopsy," offering easy deployment via Docker scripts, comprehensive management suites for sending customized lures, and integrated self-defense mechanisms. These defenses include hosting their own DNS servers to evade detection, returning vanilla or redirecting content to scanners that aren't specific targets, and leveraging the Certificate Transparency (CT) logs to appear legitimate to automated checkers until a specific lure is activated. Torrey humorously notes that the statistic of "80% of all fishing" is actually more of a "vibe percent" due to its pervasive nature.

A critical point of concern highlighted by Torrey is the inadequacy of most Multi-Factor Authentication (MFA) methods against modern phishing. He states that approximately two-thirds of common MFA types are not phishing resistant. This includes SMS-based MFA (vulnerable to SIM swapping and other phone network issues), time-based one-time passwords (TOTP) from hardware tokens or authenticator apps, and even push notifications. These methods are susceptible because an Adversary-in-the-Middle (AiTM) proxy can simply intercept and replay the session tokens or push approvals. Push bombing, where an attacker repeatedly sends MFA push requests, hoping the user will accidentally or out of frustration approve, is another common tactic.

The talk introduces device-bound passkeys as the sole "silver bullet" against modern phishing. Passkeys employ cryptographic signing tied to the specific domain the user is interacting with. If a user attempts to authenticate on a fake phishing site, the passkey generates a signature for that fake domain, which will be rejected by the legitimate service. This cryptographic binding makes passkeys inherently resistant to AiTM and browser-in-the-middle attacks.

Finally, Torrey touches upon the shared responsibility model in cloud security, particularly concerning Identity and Access Management (IAM). He identifies a "seam" where customer and vendor responsibilities meet, creating a blind spot that attackers exploit. Customers often lack the raw telemetry and granular visibility that cloud providers possess, making it challenging to detect early-stage phishing attempts or understand the full scope of attacks targeting their outsourced identity infrastructure. This lack of transparency is a significant hurdle for effective defense.

Key Findings

▶ Watch: Adversary-in-the-Middle (AiTM): prevalent, effective, defeats MFA (8:00)

Jacob Torrey's presentation unravels several critical findings about the current state of phishing and its defenses, underscoring the dynamic and often asymmetrical nature of this cyber conflict.

Firstly, the talk firmly establishes that phishing is not a static or solved problem but a highly dynamic and actively contested area. The "cat-and-mouse" analogy is not merely figurative; new attack techniques and defensive measures are developed and countered on a near-monthly basis, as illustrated by Torrey's timeline of recent developments. This constant evolution demands continuous vigilance and adaptation from defenders.

Secondly, Adversary-in-the-Middle (AiTM) phishing is identified as the dominant and most effective technique, accounting for approximately "80% or so" of modern credential harvesting attacks. AiTM kits, like EvilJinx, are lightweight, easy to deploy, and bypass most traditional MFA methods by acting as a transparent proxy that intercepts and relays session cookies and authentication challenges. This finding highlights the inadequacy of many widely adopted MFA solutions.

A significant finding from Canary's own research and deployment is the initial success and subsequent challenges of their CSS-based detection method for Microsoft Entra ID logins. By injecting invisible CSS that attempts to load an image from a controlled domain, Canary could detect phishing attempts by analyzing the HTTP referer header. This innovative approach provided customers with much-needed visibility into phishing attempts on a platform where direct JavaScript injection for security monitoring is not permitted. The system proved highly effective, protecting "millions and millions of logins" for a remarkably low cost (around $400/month for the free open-source token).

However, adversaries quickly adapted. The release of EvilJinx Pro directly addressed this detection by implementing a Referrer-Policy override, instructing the browser not to send the referer header. This bypass, combined with a coincidental fix in Chrome for a long-standing bug that previously ignored such policies, rendered Canary's initial detection method less effective against the latest phishing kits. This rapid adaptation by attackers underscores the transient nature of many defensive innovations.

In response, Canary developed a counter-bypass using CSS Unicode encoding. By obfuscating the CloudFront domain within the CSS using hex escape sequences (\0000XX), they exploited a "parser differential" where legitimate browsers correctly normalize the Unicode to load the image, but EvilJinx's regex for blocking CloudFront URLs fails to recognize the encoded string. This demonstrated the ongoing ingenuity required in the defensive arms race.

Finally, Torrey highlights the emergence of highly sophisticated and targeted attacks, such as the technique presented by Keanu Unice at Defcon 33. This method allows attackers to conduct phishing entirely within the legitimate login.microsoft.com domain, even defeating MFA, by manipulating custom fonts and login_hint parameters within Microsoft Entra ID branding. While complex and likely reserved for targeted attacks, it represents the bleeding edge of phishing sophistication and a future threat that defenders must anticipate.

A silver lining in this grim landscape is the observed lag between red team presentations and widespread adoption by "lazy" attackers. Torrey notes that Canary still catches many attackers using older versions of EvilJinx 2 that are vulnerable to the original referer detection, indicating that not all adversaries immediately adopt the latest bypasses. This provides a crucial window for defenders to implement new protections before they become universally necessary.

Technical Deep Dive

▶ Watch: Why most MFA fails and passkeys succeed (10:30)

The technical core of Jacob Torrey's talk delves into the intricacies of modern phishing techniques and Canary's innovative, albeit constantly challenged, detection mechanisms. Understanding these technical details is crucial for appreciating the sophistication of current threats and the ingenuity required for effective defense.

Modern Phishing Kits and Techniques

Torrey categorizes modern phishing into several advanced methods, moving beyond simple static page mirrors:

1. Browser-in-the-Browser (BitB): This technique leverages JavaScript and CSS to create a fake browser window within the victim's legitimate browser. The "window" appears to be a legitimate login prompt (e.g., for Microsoft), complete with a seemingly correct URL in the address bar and even themed according to the user's OS settings (dark mode, etc.). However, it's merely a visual illusion, not a true browser window. The user enters credentials into this fake interface, which are then harvested. Torrey notes the difficulty of creating such a convincing UI using front-end technologies.

1. Browser-in-the-Middle (BitM): More resource-intensive, BitM involves hosting a full, legitimate browser (e.g., Chrome) in the cloud. This browser navigates to the target login page, and its display is then streamed to the victim's browser using technologies like NoVNC or Guacamole. To the target service, it appears as a genuine client. The attacker runs a keylogger or captures credentials within the hosted browser environment. This method is "pretty clever" because it bypasses many iframe-breaking and client-side detection techniques, but it's "very expensive" due to the infrastructure required to host many browser instances for a large-scale attack. Torrey aptly describes it with a "Yo Dawg" meme reference: "Hey, you like your browser, so I put a browser in your browser so you can browse while you browse."

1. Adversary-in-the-Middle (AiTM): This is the most prevalent and effective technique, accounting for roughly 80% of credential phishing. An AiTM setup acts as a transparent proxy between the victim and the legitimate target site. The victim navigates to the attacker's phishing domain, which then proxies all traffic to and from the real service. When the user authenticates, the AiTM proxy intercepts and harvests session IDs and other authentication tokens. This method is "very lightweight" and "works really well if you have most types of MFA," as it simply relays the legitimate MFA challenge and captures the resulting authenticated session. Simple rewrite rules (e.g., using regex) are used to ensure that URLs displayed to the user appear legitimate while the proxy handles the actual routing and harvesting. Tools like EvilJinx are prime examples of sophisticated AiTM kits.

Canary's CSS-Based Detection and the Arms Race

Canary, facing the challenge of gaining visibility into phishing attempts on platforms like Microsoft Entra ID where customers cannot inject custom JavaScript, devised an ingenious CSS-based token.

1. The Problem: Microsoft Entra ID allows organizations to customize their login page branding with custom CSS, but not arbitrary JavaScript. This limits a customer's ability to implement client-side detection logic. Entra ID logs also suffer from significant delays (5-15 minutes to 3 hours), meaning detections are often post-compromise.

1. The Initial Solution (Canary CSS Token):

• Canary discovered that custom CSS uploaded to Entra ID's company branding can instruct the browser to load external resources.
• They created a tiny, invisible CSS snippet that, when downloaded by the user's browser, tells it to load a 1x1 image gif from a specific URL hosted on AWS CloudFront.
• A CloudFront function (a lightweight serverless function running at the edge) at the image's URL inspects the HTTP referer header.
• If the referer is not login.microsoftonline.com (or other official Microsoft domains), it indicates that a phishing proxy is in the middle. The CloudFront function then redirects the browser to a Canary tokens server, triggering an alert (email, webhook) with details about the client and the phishing domain before the user even enters their password.
• This method was highly effective, catching "unique fishing attacks probably on the order of like a dozen or so every couple days" and detecting cases where SSL certificates were registered the same day as the phishing attempt.

1. EvilJinx Pro Bypass:

• Adversaries quickly adapted. EvilJinx Pro, a popular AiTM toolkit, introduced a feature to bypass this detection.
• It achieves this by setting an Referrer-Policy header (e.g., no-referrer or same-origin) in the proxied HTTP responses. This policy instructs the victim's browser not to send the Referer header when requesting resources from other origins.
• Coincidentally, a long-standing bug in Chrome where it ignored referrer policies was fixed around the same time EvilJinx Pro was released. This combination rendered Canary's referer-based detection ineffective against the latest EvilJinx versions. The EvilJinx developer even publicly shared information on how to block Canary's CloudFront domains.

1. Canary's Counter-Bypass (CSS Encoding):

• To combat the Referrer-Policy bypass, Canary developed a new technique leveraging CSS Unicode encoding.
• Instead of embedding the CloudFront domain directly in the CSS, they now encode it using Unicode hex escape sequences (e.g., \0000XX).
• Modern browsers (like Chrome) normalize these Unicode code points before parsing the URL, meaning \000043\00006c\00006f\000075\000064\000046\000072\00006f\00006e\000074 would be correctly interpreted as "CloudFront."
• However, the regex patterns used by EvilJinx to detect and block CloudFront domains in the CSS do not perform this Unicode normalization.
• This creates a "parser differential exploit": the victim's browser correctly loads the image, triggering the alert, while EvilJinx fails to detect and block the embedded URL, thinking there's "no CloudFront here." This restored some detection capabilities against newer EvilJinx deployments.

The Ultimate Sophistication: Keanu Unice's Defcon Attack

Torrey briefly highlights a highly advanced attack vector presented by Keanu Unice at Defcon 33, which pushes the boundaries of phishing by keeping the victim entirely on a legitimate Microsoft domain:

1. Lookalike Domain Acquisition: The attacker registers a domain very similar to the target's (e.g., jacobthinkst.com instead of jacobthinks.com).
2. Entra ID Tenant Setup: An Entra ID tenant is created for this lookalike domain, and ownership is verified.
3. On-Prem AD Integration: The Entra ID tenant is configured to use on-premises Active Directory (AD) for authentication.
4. Compromised AD: Info-stealing malware is installed on the on-prem AD server.
5. Custom Font Manipulation: The attacker leverages Entra ID's company branding feature to upload a custom font. This font is meticulously crafted to visually alter the "off" letter in the lookalike domain (e.g., changing the t in thinkst.com to appear as an s), making it visually indistinguishable from the legitimate domain (thinks.com).
6. Lure and Login Hint: The phishing lure directs the victim to login.microsoft.com but includes a login_hint parameter (URL-encoded) specifying the lookalike domain (e.g., [email protected]).
7. Legitimate Domain, Phished Credentials: The user sees login.microsoft.com, which is a legitimate, SSL-signed Microsoft domain. The custom font makes the login_hint look correct. The user enters credentials, which are then routed to the compromised on-prem AD server and harvested.
8. MFA Bypass: The attack then redirects the user to another Entra ID tenant, also on login.microsoft.com, which is configured with dynamically generated images for company branding. These images are used to simulate and defeat MFA push notifications, keeping the entire interaction within the legitimate Microsoft domain while still compromising the user's authentication.

This "pretty cool and really scary" attack demonstrates that even relying on the legitimacy of the domain bar is insufficient against truly sophisticated, targeted adversaries. While Torrey believes "lazy attackers" won't widely adopt this complex method, it represents a significant future threat.

Demo / Proof of Concept

▶ Watch: Cat-and-mouse: Evil Jinx bypasses, Canary counters (18:00)

While Jacob Torrey's talk did not feature a live, interactive demonstration of a phishing attack or the Canary token in action, he thoroughly explained the mechanics and presented the proof of concept for Canary's CSS-based detection. He walked through the process of how the invisible CSS is injected into the Microsoft Entra ID branding, how it attempts to load an image from a controlled CloudFront URL, and how the HTTP referer header is then inspected by a CloudFront function.

Torrey showed a visual representation of the outcome, describing "what happens when it's great" and displaying a screenshot of a Canary token alert. This alert, which could be an email or a webhook notification, clearly indicates that a phishing attempt has been detected, including details about the client and the offending phishing domain. This practical evidence underscores the token's effectiveness in providing early warning to organizations, often before credentials are even entered by the victim. The discussion of the subsequent bypass by EvilJinx Pro and Canary's CSS encoding counter-bypass further illustrates the iterative nature of this real-world security arms race, with each step serving as a proof point for the evolving capabilities of both attackers and defenders.

Defensive Implications

▶ Watch: Final thoughts: MFA, attacker lag, cloud visibility cost (24:00)

Jacob Torrey's talk provides critical defensive insights, urging a shift in strategy to counter the rapidly evolving phishing landscape. The implications for defenders are profound and necessitate a multi-faceted approach.

1. Embrace Phishing-Resistant MFA (Passkeys): The most crucial takeaway is the imperative to move towards phishing-resistant MFA. Torrey unequivocally states that device-bound passkeys are the "only silver bullet" against modern AiTM attacks. Unlike traditional MFA (SMS, push notifications, TOTP) that can be proxied, passkeys cryptographically bind the authentication to the legitimate domain. Organizations, even "legacy enterprise blahy blah blah," must prioritize their deployment. PKI (Public Key Infrastructure) is also phishing-resistant but deemed too difficult for widespread deployment.

1. User Awareness Training is Insufficient: While user education remains important, Torrey stresses that "no user awareness training... will defeat any of these things especially a dedicated attacker." The sophistication of modern phishing, particularly BitB and AiTM, makes it incredibly difficult for even tech-savvy users to discern fake from real, especially when the URL appears legitimate. Defenders must assume users will eventually be phished and build layered defenses.

1. No Single Detection is a Panacea: The constant "cat-and-mouse" game means that any single detection method, no matter how clever, is eventually bypassed. Defenders must adopt a layered approach, combining various detection techniques and continuously evolving them. The example of Canary's CSS token, its bypass by EvilJinx Pro, and the subsequent counter-bypass through CSS encoding perfectly illustrates this dynamic.

1. Address Visibility Gaps in Cloud IAM: A significant challenge for organizations leveraging cloud identity providers like Microsoft Entra ID is the lack of raw telemetry and granular visibility. Torrey highlights the "seam" in the shared responsibility model, where customers are often blind to early phishing attempts targeting their outsourced identity infrastructure. When moving services "as a service," organizations must critically evaluate the "visibility cost" and demand better telemetry from their vendors or implement creative solutions like Canary's token to gain insight. Knowing how many invalid login attempts are occurring, for instance, is crucial early warning data often unavailable to customers.

1. Leverage Available Detection Tools (e.g., Canary CSS Token): Despite its limitations against the absolute latest phishing kits, the Canary CSS token remains valuable. Torrey emphasizes that there's a "super clear lag between what a red teamer writes up and presents at Defcon and what we see in the wild." Many attackers still use older versions of EvilJinx (e.g., EvilJinx 2, which is "three versions old") that are vulnerable to the original referer detection. The token is "free and easy to deliver" for Azure tenants, offering early warning against "low effort" attackers who use "complete nonsense domain[s]" and mass-spam.

1. Anticipate Future Threats from Red Team Research: Defenders should actively follow red team presentations at conferences like Defcon. While complex attacks like Keanu Unice's Microsoft login page hosting might not be immediately widespread, they represent the future of sophisticated phishing. Understanding these cutting-edge techniques allows defenders to proactively develop countermeasures or at least be aware of what's coming.

1. Re-evaluate the Cost of Outsourcing: Torrey urges organizations to consider the often-overlooked "visibility cost" when deciding whether to host services internally or outsource them to the cloud. While cloud services offer convenience and scale, they can also "outsourc[e] some of the things and making detection engineering a lot harder." A comprehensive cost-benefit analysis should include the impact on security visibility and the ability to detect and respond to threats.

In essence, defenders must recognize that phishing is a continuous, intelligent adversary. The focus must shift from simply educating users or deploying basic MFA to implementing robust, cryptographically strong authentication, actively monitoring for novel attack vectors, and strategically filling visibility gaps, especially in cloud environments.

Key Takeaways

• Phishing is a highly dynamic and persistent threat: It's an active "cat-and-mouse" game with new attack techniques and defensive bypasses emerging on a near-monthly basis.
• Device-bound passkeys are the "silver bullet": They are the only truly phishing-resistant MFA, leveraging cryptographic signing tied to the legitimate domain, rendering AiTM and BitM attacks ineffective.
• Adversary-in-the-Middle (AiTM) is the dominant threat: This technique, exemplified by tools like EvilJinx, is lightweight, easy to deploy, and bypasses approximately two-thirds of traditional MFA methods by proxying sessions.
• Visibility gaps in cloud IAM are critical vulnerabilities: Organizations outsourcing Identity and Access Management (e.g., to Microsoft Entra ID) often lack the granular telemetry needed for early phishing detection, creating a "seam" where attackers thrive.
• Clever, simple detections still provide value: Despite rapid bypasses, tools like Canary's CSS token (even with its encoding counter-bypass) can still catch "lazy" attackers using older phishing kits or less sophisticated methods, offering crucial early warnings.
• Anticipate and prepare for advanced attacks: While complex red team techniques (e.g., Microsoft login page hosting via custom fonts) may not be immediately widespread, they represent future threats that defenders should understand and proactively address.

About the Speaker(s)

Jacob Torrey is a security researcher at Canary, a company known for its "Canary tokens" which are designed to detect unauthorized access and activity. Throughout his talk, Torrey demonstrates deep technical expertise in the evolving landscape of phishing attacks and defenses, including the intricacies of modern phishing kits and the development of innovative detection mechanisms like the CSS-based Canary token for Microsoft Entra ID. His work at Canary involves creating tools and strategies to help organizations gain visibility and defend against sophisticated cyber threats.