Invisible Obfuscation Technique Used in PAC Attack

Date: 02/19/2025

Severity: Medium

Summary

The "Invisible Obfuscation Technique Used in PAC Attack" involves encoding binary data using Hangul half-width and full-width Unicode characters, representing 0 and 1, to hide a payload in a JavaScript script. This technique, first demonstrated in October 2024, was incorporated into a phishing attack targeting affiliates of a major American political action committee (PAC) in January 2025. The payload is executed through a Proxy get() trap when accessed.

Indicators of Compromise (IOC) List

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Reference:

https://blogs.juniper.net/en-us/threat-research/invisible-obfuscation-technique-used-in-pac-attack