Our Phishing Attack Technique Explorer is now live! 😈🔍

Next time you browse our catalogue, you'll see a new view to find payloads combining popular attack techniques; from Pastejacking and Bring Your Own Interpreter, to HTML Smuggling and Auth Coercion.

Find out more at delivr.to/app/payloads

Closing the books on 2024! ✨

Thank you to everyone who's been a part of delivr.to's journey this year! We’re incredibly excited about what’s coming your way in 2025—stay tuned!

Happy New Year everyone! 🎉

In-the-wild samples are leveraging "foreignObject" elements to embed interactive HTML elements that take user input and exfiltrate it to attacker controlled servers.

🔍 Detect with our YARA rule: github.com/delivr-to/de...
🛡️ Test weaponised SVG delivery: delivr.to/?search=.svg

Viewing a zip concat. sample, we can see the populated zip file header (0x04034b50-blue) and the end of central directory record (EOCD) signature (0x06054b50-red) repeated for each zip

In our testing, multiple instances of these byte sigs reliably detected this technique

🧵3/3

This technique results in different files being displayed to an end user (either from the leading or trailing zip file) depending on zip client used

This also has implications for mail filters that ‘open’ the zip to analyse its contents

🧵2/3