The single word that best describes the title of this post is: Obfuscation. Obfuscation is the obscuring of the intended meaning of communication by making the message difficult to understand, usually with confusing and ambiguous language. The obfuscation might be either unintentional or intentional (although intent usually is connoted), and is accomplished with circumlocution (talking around the subject), the use of jargon (technical language of a profession), and the use of an argot (ingroup language) of limited communicative value to outsiders. Cyber Criminals base all of their attacks on these premises.
Much of what is presented to us on the internet is specially formatted for readability and ease of use. Here is one example: Fake Captcha Malware Attacking Windows Users To execute PowerShell Commands looks just fine. The words make sense and yet we cannot “see” where we are really going to go if the link is clicked. Now, here is what looks like the same link Fake Captcha Malware Attacking Windows Users To execute PowerShell Commands. On the surface, these look exactly the same, and yet they are not. This is what the cybercriminals are doing. They are relying on our clicking the link without pausing to see where it might take us.
The cybercriminals have upped the challenge by using something we have become accustomed to. Captcha is used to separate robots or bots from humans. They are the popups that ask which pictures have a car, bus, bicycle, and so forth. Like the examples above they reside on the web at a specific address which may or may not be where you are expecting to go.
Here is an example of how what you see is not what you think.
This is a picture of an email that landed in my mailbox:
Looks easy right?
Well here is the what “open” box actually contains. First the link, then the contents of the link:
Nowhere near what one would expect. Note that the highlighted section is the actual website where the payload used to reside.
Of interest is that the domain was created on 2025-04-07.
What does the “share” button option look like?
Same details just a slightly different look.
The bottom line is that regardless of what the email appears to contain it is wise to not click on anything if you do not know the sender or if the email just “appears” out of nowhere and asks for you to click on a link.
Remember that Lead IT Consulting is here to help small businesses understand and navigate challenges in the IT landscape so your business can grow. We eat, live, and breathe navigating IT challenges daily to minimize risks and work for our clients. To find out more about how Lead IT Consulting can help your company with this and more book a meeting with the author or send an email to happiness@leaditconsulting.net.
