• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to footer

My TechDecisions

  • Best of Tech Decisions
  • Topics
    • Video
    • Audio
    • Mobility
    • Unified Communications
    • IT Infrastructure
    • Network Security
    • Physical Security
    • Facility
    • Compliance
  • RFP Resources
  • Resources
  • Podcasts
  • Project of the Week
  • About Us
    SEARCH
Network Security

Hackers Used Morse Code In This Phishing Attack

Hackers' are becoming more sophisticated by using Morse code to evade detection in latest XLS.HTML phishing attack.

August 18, 2021 Alyssa Borelli Leave a Comment

Hackers use morse code to evade detection
Thaut Images/ stock.adobe.com

In the latest string of evolving sophisticated phishing attacks, Microsoft has revealed hackers are using a new tactic—Morse code to evade detection.

After a year-long investigation, Microsoft 365 Defender Threat Intelligence Team discovered an unknown cybercriminal group was harvesting user credentials via an invoice-themed XLS.HTML phishing campaign.

The HTML attachment included JavaScript files used to steal passwords, which were then encoded using different mechanisms. The attackers moved from using the plaintext HTML code to employing multiple encoding techniques like Morse code. The operators kept changing their encryption mechanisms every 37 days on average, according to Microsoft.

The attachment is comparable to a jigsaw puzzle; segments of the HTML file may appear harmless at code level and may slip past conventional security solutions. “When the segments are put together and properly decoded does the malicious intent show,” writes Microsoft in a blog post.

Related: Ivanti: IT Is Losing The Phishing Fight

The XLS.HTML phishing campaign sent emails mimicking financial-related business transactions, such as a payment advice. The attachment is an HTML file, but the extension is modified using a variation of Excel like type files; xls.HTML, xslx.HTML, Xls.html, etc.

Unbeknownst victims are prompted to open the excel file. Once it’s opened, a browser window will display a fake Microsoft 365 dialog box to enter credentialed information, such as email address and password.

If the user enters their credentials, they’ll receive a fake note that the password is incorrect. Meanwhile, the phishing scheme is running in the background harvesting the password and other information about the user.

Microsoft recommends IT teams should perform the following to reduce impact of this phishing attack:

  • Use mail flow rules or Group Policy for Outlook to strip .html or .htm or other file types that are not required for business.
  • Turn on Safe Attachments policies to check attachments to inbound email. Enable Safe Links protection for users with zero-hour auto purge to remove emails when a URL gets weaponized post-delivery.
  • Avoid password reuse between accounts and use multi-factor authentication (MFA).
  • Educate end users on phishing tactics as part of security or phishing awareness training.

Additionally, you can look for alerts within the Microsoft 365 Security Center for emails delivered with xslx.html/xls.html attachments.

To locate specific attachments related to this campaign, run the following query:

// Searches for email attachments with a specific file name extension xls.html/xslx.html
EmailAttachmentInfo
| where FileType has “html”
| where FileName endswith_cs “._xslx.hTML” or FileName endswith_cs “_xls.HtMl” or FileName endswith_cs “._xls_x.h_T_M_L” or FileName endswith_cs “_xls.htML” or FileName endswith_cs “xls.htM” or FileName endswith_cs “xslx.HTML” or FileName endswith_cs “xls.HTML” or FileName endswith_cs “._xsl_x.hTML”
| join EmailEvents on $left.NetworkMessageId == $right.NetworkMessageId
| where EmailDirection == “Inbound”

If you enjoyed this article and want to receive more valuable industry content like this, click here to sign up for our digital newsletters!

Tagged With: Microsoft 365, Microsoft Defender, Microsoft Excel, Morse code, phishing attacks

Related Content:

  • Cybersecurity and information or network protection. Future technology web services for business and internet project CrowdStrike Cyber Armageddon: How Do Firms Now Build…
  • DDoS, NETSCOUT Arbor Insight 7 Layers of DDoS Attacks and How To…
  • cisco webex-rooms-modern-space AVI-SPL Receives Cisco 2023 Reimagine Workspaces Partner of…
  • data breach Nearly 900 Schools Impacted by National Student Clearinghouse…

Free downloadable guide you may like:

  • Download TechDecisions' Blueprint Series report on Security Awareness now!Blueprint Series: Why Your Security Awareness Program is Probably Falling Short

    Learn about the evolution of phishing attacks and best practices for security awareness programs to ensure your organization is properly prepared to defend against them in this report from TechDecisions' Blueprint Series.

Reader Interactions

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Latest Downloads

Practical Design Guide for Office Spaces
Practical Design Guide for Office Spaces

Recent Gartner research shows that workers prefer to return to the office for in-person meetings for relevant milestones, as well as for face-to-fa...

New Camera Can Transform Your Live Production Workflow
New Camera System Can Transform Your Live Production Workflow

Sony's HXC-FZ90 studio camera system combines flexibility and exceptional image quality with entry-level pricing.

Creating Great User Experience and Ultimate Flexibility with Clickshare

Working and collaborating in any office environment today should be meaningful, as workers today go to office for very specific reasons. When desig...

View All Downloads

Would you like your latest project featured on TechDecisions as Project of the Week?

Apply Today!

More from Our Sister Publications

Get the latest news about AV integrators and Security installers from our sister publications:

Commercial IntegratorSecurity Sales

AV-iQ

Footer

TechDecisions

  • Home
  • Welcome to TechDecisions
  • Contact Us
  • Comment Guidelines
  • RSS Feeds
  • Twitter
  • Facebook
  • Linkedin

Free Technology Guides

FREE Downloadable resources from TechDecisions provide timely insight into the issues that IT, A/V, and Security end-users, managers, and decision makers are facing in commercial, corporate, education, institutional, and other vertical markets

View all Guides
TD Project of the Week

Get your latest project featured on TechDecisions Project of the Week. Submit your work once and it will be eligible for all upcoming weeks.

Enter Today!
Emerald Logo
ABOUTCAREERSAUTHORIZED SERVICE PROVIDERSYour Privacy ChoicesTERMS OF USEPRIVACY POLICY

© 2025 Emerald X, LLC. All rights reserved.