Flying Under the Radar - New Security Evasion Techniques
summary
Demonstrations show attackers chaining concrete evasion steps: phishing kits validate cards with Luhn/BIN checks, deliver one‑time pages and randomized folders, and hide resources via HTML smuggling (SVG base64) to bypass scanners; malware uses crypting services and generative AI to morph signatures, device‑spoofing services to defeat device ID, anti‑debugging that detects DevTools, and legitimate services (Trello/Telegram/Google Drive) as C2 and drop zones — a Trello PoC successfully lists directories and exfiltrates a file; mitigations: sanctioned apps, tenant restrictions, action blocking and content DLP.
AI-written summary · about
chapters (8)
- 0:00New evasion techniques
- 1:25Phishing and malware evasion history
- 14:40Modern phishing threats
- 20:02Microsoft O365 phishing demo
- 29:52Malware evasion with legit tools
- 39:52Living off the cloud attacks
- 47:17Defensive strategies
- 51:16Summary
related talks
43mBypassing Malware Detection Mechanisms in Online Banking
39mReal-World Detection Evasion Techniques in the Cloud
30mEvasive Maneuvers: Trends in Phishing Evasion & Anti-Evasion
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
01h 01mSomething Something Cyber
46mAttacks, Lies and the Underground World
46mThe 5 Most Dangerous New Attack Techniques and How to Counter Them
30mProfessionals hack people, not systems