Cybersecurity firms commonly use headless devices or virtual machines to determine if a website is used for phishing.
Discovered by MalwareHunterTeam, the script checks the visitor’s screen’s width and height and uses the WebGL API to query the rendering engine used by the browser.
When performing the checks, the script will first see if the browser uses a software renderer, such as SwiftShader, LLVMpipe, or VirtualBox. Software renderers commonly indicate that the browser is running within a virtual machine.
The script also checks if the visitor’s screen has a color depth of less than 24-bits or if the screen height and width are less than 100 pixels, as shown below.
If it detects any of these conditions, the phishing page will display a message in the browser’s developer console and show an empty page to the visitor.
However, if the browser uses a regular hardware rendering engine and a standard screen size, the script will display the phishing landing page.
Fabian Wosar, CTO of cybersecurity firm Emsisoft, told BleepingComputer that security software utilize a variety of methods to scan for and detect phishing sites. These include signature matching and visual machine using machine learning.
As it’s common for researchers and security companies to harden their virtual machines to evade detection by malware, it appears they will now also have to harden them against phishing attacks.
As a way to see what renderer and screen information is reported by your browser, BleepingComputer has created a test page that you can use.