Netskope’s DL-IPD Inline Phishing Detection Engine uses deep learning to inspect real web content in real time, addressing the limits of offline blocklists and static detectors. The post showcases patient-zero and evasive phishing examples (credential theft, health scams, malicious adware) and explains how dynamic content, obfuscation, and image-based pages can evade traditional detectors, while DL-IPD learns patterns to block such pages.
#CTTCorreiosdePortugal #Netskope #DLIPD #InlinePhishingDetection #HealthScam #MaliciousAdware #JavaScript #Base64
#CTTCorreiosdePortugal #Netskope #DLIPD #InlinePhishingDetection #HealthScam #MaliciousAdware #JavaScript #Base64
Keypoints
- Netskope introduces DL-IPD, a deep learning-based engine that inspects live web content to block phishing in real time and complements offline analyzers and blocklists.
- The model continuously learns phishing page behavior to identify patient-zero campaigns and evasive attacks that other detectors miss.
-
-
MITRE Techniques
- [T1059.007] JavaScript – Attackers may use JavaScript to dynamically generate phishing content; “Attackers may use JavaScript to dynamically generate the phishing page on the fly. This means that the phishing page is not visible in the page source code, making it harder for detection tools to accurately detect the page. The following phishing page detected by Netskope uses Javascript to add all the DOM elements after getting loaded on the victim’s browser.”
- [T1132] Data Encoding – Use of Base64-encoded images to render the login form, hiding the HTML structure; “The entire HTML code of this page consists of a Base64 encoded image rendered in the background as an authentication form.”
- [T1566] Phishing – Credential theft phishing pages designed to look like legitimate sites to harvest login and payment data; “Credential theft phishing pages are designed to look like legitimate websites, such as online services or e-commerce websites, and trick users into entering their login credentials and credit card information.”
- [T1566] Phishing – Evasive or cloaked phishing techniques (e.g., cloaking, URL rotation, obfuscation, dynamic code generation) to bypass detectors; “Phishing attacks are becoming more sophisticated with the use of cloaking, URL rotation, obfuscation, and dynamic code generation.”
Indicators of Compromise
- [URL] – sample phishing-related URLs and domains used in campaigns – http://lsodeo[.]dbe[.]gov.mm/wp-admin/.Adminser/CTT/signin[.]php, http://lsodeo[.]dbe[.]gov[.]mm/wp-admin/.Adminser/CTT/wallet[.]php?a8475af7b320248b7381898ca5fbe81485268095, and 6 more URLs