{ "id": "ad5bb889-f2c5-4ade-9cc5-1a941dee753d", "created_at": "2026-04-06T00:07:24.560297Z", "updated_at": "2026-04-10T03:21:06.431565Z", "deleted_at": null, "sha1_hash": "ea0c2d6daab22b0bef26741922861077abdde707", "title": "TrickBot phishing checks screen resolution to evade researchers", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 2247999, "plain_text": "TrickBot phishing checks screen resolution to evade researchers\r\nBy Ionut Ilascu\r\nPublished: 2021-11-26 · Archived: 2026-04-05 15:43:34 UTC\r\nThe TrickBot malware operators have been using a new method to check the screen resolution of a victim system to evade\r\ndetection of security software and analysis by researchers.\r\nLast year, the TrickBot gang added a new feature to their malware that terminated the infection chain if a device was using\r\nnon-standard screen resolutions of 800x600 and 1024x768.\r\nIn a new variation spotted by threat researchers, the verification code has been added to the HTML attachment of the\r\nmalspam delivered to the potential victim.\r\nhttps://www.bleepingcomputer.com/news/security/trickbot-phishing-checks-screen-resolution-to-evade-researchers/\r\nPage 1 of 4\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/trickbot-phishing-checks-screen-resolution-to-evade-researchers/\r\nPage 2 of 4\n\nVisit Advertiser websiteGO TO PAGE\r\nA borrowed trick\r\nResearchers usually analyze malware in virtual machines that come with certain particularities - especially on default\r\nconfigurations - such as running services, name of the machine, network card, CPU features, and screen resolution.\r\nMalware developers are aware of these characteristics and take advantage of implementing methods that stop the infection\r\nprocess on systems identified as virtual machines.\r\nIn TrickBot malware samples found last year, the executable included JavaScript code that verified the screen resolution of\r\nthe system it was running on.\r\nRecently, TheAnalyst - a threat hunter and member of the Cryptolaemus security research group, found that the HTML\r\nattachment from a TrickBot malspam campaign behaved differently on a real machine than on a virtual one.\r\nThe attachment downloaded a malicious ZIP archive on a physical system but redirected to the ABC's (American\r\nBroadcasting Company) website in a virtual environment.\r\nIf the target opens the HTML in their web browser, the malicious script is decoded and the payload is deployed on their\r\ndevice.\r\nThe email carrying the attachment was a fake alert for purchasing insurance, with details added to an HTML attachment.\r\nOpening the attachment launched the HTML file in the default web browser, displaying a message asking for patience for\r\nthe document to load and providing a password to access it.\r\nOn a regular user’s machine, the infection chain would continue with downloading a ZIP archive that included the TrickBot\r\nexecutable, just as seen in the image below, published by TheAnalyst:\r\nDownloading malware this way is a technique known as HTML smuggling. It allows a threat actor to bypass a browser's\r\ncontent filters and sneak malicious files on a target computer by including encoded JavaScript into an HTML file.\r\nWhile this appears to be an innovation from TrickBot operators, the trick is not new and has been seen before in attacks\r\nluring victims to phishing sites.\r\nSecurity researcher MalwareHunterTeam found in March this year a phishing kit that included code for checking the\r\nsystem's screen resolution.\r\nSince then, the researcher told BleepingComputer that he saw the tactic being used multiple times in various phishing\r\ncampaigns as a means to avoid investigators.\r\nThe script determines if the user landing on the phishing page uses a virtual machine or a physical one by checking if the\r\nweb browser uses a software renderer like as SwiftShader, LLVMpipe, or VirtualBox, which typically means that a virtual\r\nenvironment.\r\nAs seen above, the script also checks if the color depth of the visitor's screen is less than 24-bits, or if the screen height and\r\nwidth are less than 100 pixels.\r\nTrickBot is not using the same script as the one above but relies on the same tactic to detect a researcher's sandbox.\r\nHowever, it's a premiere for the gang to use such a script in an HTML attachment.\r\nThis may also be the first time malware uses an attachment to run a screen resolution check rather than doing it on the\r\nlanding page serving the malware executable.\r\nPreviously, the malware checked for non-standard screen resolutions 800x600 and 1024x768, which are indicative of a\r\nvirtual machine.\r\nhttps://www.bleepingcomputer.com/news/security/trickbot-phishing-checks-screen-resolution-to-evade-researchers/\r\nPage 3 of 4\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/trickbot-phishing-checks-screen-resolution-to-evade-researchers/\r\nhttps://www.bleepingcomputer.com/news/security/trickbot-phishing-checks-screen-resolution-to-evade-researchers/\r\nPage 4 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "references": [ "https://www.bleepingcomputer.com/news/security/trickbot-phishing-checks-screen-resolution-to-evade-researchers/" ], "report_names": [ "trickbot-phishing-checks-screen-resolution-to-evade-researchers" ], "threat_actors": [], "ts_created_at": 1775434044, "ts_updated_at": 1775791266, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/ea0c2d6daab22b0bef26741922861077abdde707.pdf", "text": "https://archive.orkl.eu/ea0c2d6daab22b0bef26741922861077abdde707.txt", "img": "https://archive.orkl.eu/ea0c2d6daab22b0bef26741922861077abdde707.jpg" } }