Cover image

Writing an IOK rule for a WhatsApp phishing kit

Bradley's author profile picture
Bradley Kemp on

Let's write an IOK signature for a WhatsApp phishing kit which targeted Chinese-speaking users for a couple of months in summer 2023.

Screenshot of the phishing kit we'll be detecting.
Screenshot of the phishing kit we'll be detecting.

First off, how was this phishing site created?

(this makes a huge difference to how hard this will be to detect) Lucky for us, this was created by cloning the real web.whatsapp.com page. You can easily tell by the "mark of the web" snippet in the HTML:

<!DOCTYPE html>
<!-- saved from url=(0025)https://web.whatsapp.com/ -->
<html class="js serviceworker adownload cssanimations csstransitions webp exiforientation webp-alpha webp-animation webp-lossless">
...
...

This makes our life much easier because company webpages tend to make many more requests and have lots of idiosyncrasies we can use for detection compared to a phishing page built from scratch.

Our first lead

The first place I always check for phishing kit signature opportunities is the urlscan.io HTTP requests tab. Sure enough, there's a bunch of JS and CSS used by the page which have very unique names.

From: https://urlscan.io/result/c974e4e5-fd8b-48df-8c87-a899b9648de9#transactions
From: https://urlscan.io/result/c974e4e5-fd8b-48df-8c87-a899b9648de9#transactions

Many of these would work as the basis of an IOK signature, but I'll pick this request:

runtime.553bd3703a09c9bde8f5.js

Looking at other sites that load this filename we can see just 15 results:

From: https://urlscan.io/search/#filename:%22runtime.553bd3703a09c9bde8f5.js%22
From: https://urlscan.io/search/#filename:%22runtime.553bd3703a09c9bde8f5.js%22

The real WhatsApp Web app was loading a resource with this name, but soon afterwards we see the first of the phishing kits show up.

Writing the IOK signature

To start with our IOK signature for this phishing kit can just match based on that filename:

title: whatsapp-553bd
description: |
  A WhatsApp-web themed phishing site targeting Chinese users
references:
  - https://urlscan.io/result/3bdee4a6-c6d4-47ca-ad21-fce2a8cccc39/

detection:
  resourceRequest:
    requests|endswith: runtime.553bd3703a09c9bde8f5.js
  
  condition: resourceRequest

This is already a very high-signal signature, but it's possible there's another WhatsApp phishing site created at a similar time to this one that would also include this filename. How can we detect this specific kit?

Looking deeper into the HTML I see this promising snippet:

<div data-testid="qrcode" class="_2UwZ_" data-ref="2@MaBFYGFMcxIQdLgNUyTeuAujv0Zwx+n7RGCCD+qy3cG5gAiyAa8jdllHrUb95ZWWCq49CFeyTyCbAg==,SeCbFEOy+KEHwLfVEICKZrR9I29yQhQciSyikM4tZko=,xA1RqXwdwn/SmMrI0Xg5snRHRzb8eXnUXpv7aCocsFQ=,C2TqBSNdOTKr2dh3XFq/EI47aNJ4UIlDIR8j6GtOO04=">

This data-ref attribute looks like it might be randomly generated on every page load (and if so, can confirm for us that our signature matches this specific kit and nothing else). Reloading web.whatsapp.com a few times shows that yes, this is a random value! 🎉 So we can expand our detection rule to also check for this value:

title: whatsapp-553bd
description: |
  A WhatsApp-web themed phishing site targeting Chinese users
references:
  - https://urlscan.io/result/3bdee4a6-c6d4-47ca-ad21-fce2a8cccc39/

detection:
  resourceRequest:
    requests|endswith: runtime.553bd3703a09c9bde8f5.js

  dataRef:
    html|contains: '2@MaBFYGFMcxIQdLgNUyTeuAujv0Zwx+n7RGCCD+qy3cG5gAiyAa8jdllHrUb95ZWWCq49CFeyTyCbAg==,SeCbFEOy+KEHwLfVEICKZrR9I29yQhQciSyikM4tZko=,xA1RqXwdwn/SmMrI0Xg5snRHRzb8eXnUXpv7aCocsFQ=,C2TqBSNdOTKr2dh3XFq/EI47aNJ4UIlDIR8j6GtOO04='

  condition: resourceRequest and dataRef

Put this into the IOK editor and double check that it works:

Test out your IOK rules on phish.report/IOK
Test out your IOK rules on phish.report/IOK

Success 🎉 In just a few minutes and some light poking around in HTML, we've created a extremely high-signal detection rule that will reliably detect this phishing kit for as long as it's used by the attacker.

More posts from the Phish Report team

Cover image

Open Source Intelligence (OSINT) from common link shorteners

Phishers love to use URL shorteners, but this can actually be a benefit for defenders too. Wouldn'...
Cover image

Threat hunting for phishing sites with urlscan.io

[urlscan.io](https://urlscan.io) is an incredible tool for taking a snapshot of a phishing website...
Cover image

How the static site trend has affected phishing

The trend towards statically generated websites hasn't been limited to legitimate websites. Increa...