4 ms·
The site's dead now - the DNS record was pulled about an hour ago. But, I got a snapshot of the site and all the code before it got taken down, and I took the l
by nneonneo 8y ago
The site's dead now - the DNS record was pulled about an hour ago. But, I got a snapshot of the site and all the code before it got taken down, and I took the liberty of deobfuscating the big blobs of code:
https://github.com/nneonneo/steam-phishing-analysis https://github.com/nneonneo/steam-phishing-analysis
It's fairly simple code, in the end. The phishers copied the legitimate trading site, as well as the Steam Community login page, and then added some JavaScript code to both as well as tweaking the HTML a bit. In total, three snippets of JS were added: the first detects debuggers using https://github.com/sindresorhus/devtools-detect https://github.com/sindresorhus/devtools-detect (the bit that the original blog poster found), the second pops open the fake browser chrome and sticks the fake login page inside an iframe, and the third (running in the iframe) harvests credentials off the copied Steam login page.
- BslSJDIz1gqWxXq 8y agoHow was the JS obfuscated? Did they, by any chance, use [1]? AFAIK that tool includes a very similar anti-debugging technique. [1] https://github.com/javascript-obfuscator/javascript-obfuscator https://github.com/javascript-obfuscator/javascript-obfuscat...
- nneonneo 8y agoThey did a first pass obfuscation which replaced local variable names with gibberish and then applied some minification. Then they applied an obfuscation tool 2-3 times for each of the three code snippets, causing the code to bloat up quite considerably. However, at least two different obfuscation tools were used - one simpler one (used for the antidebugger hook) and one more complex one that looked almost like a virtual machine. The output looks a little like the output from your link, but there's a lot of structural differences so I'm not sure it was the same tool.