I received a strange phishing email the other day that seemed to use span
tags to encode "hidden" values within the email's body:
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<div dir="ltr">
<p>P<span style="color:transparent;font-size:0px">42</span>l<span style="color:transparent;font-size:0px">84</span>e<span style="color:transparent;font-size:0px">35</span>a<span style="color:transparent;font-size:0px">44</span>s<span style="color:transparent;font-size:0px">66</span>e<span style="color:transparent;font-size:0px">42</span> C<span style="color:transparent;font-size:0px">52</span>o<span style="color:transparent;font-size:0px">42</span>n<span style="color:transparent;font-size:0px">42</span>f<span style="color:transparent;font-size:0px">42</span>i<span style="color:transparent;font-size:0px">42</span>r<span style="color:transparent;font-size:0px">12</span>m<span style="color:transparent;font-size:0px">75</span> <span style="color:transparent;font-size:0px">53</span>y<span style="color:transparent;font-size:0px">42</span>o<span style="color:transparent;font-size:0px">42</span>u<span style="color:transparent;font-size:0px">24</span>r<span style="color:transparent;font-size:0px">83</span>s<span style="color:transparent;font-size:0px">42</span> <span style="color:transparent;font-size:0px">66</span>a<span style="color:transparent;font-size:0px">61</span>c<span style="color:transparent;font-size:0px">42</span>c<span style="color:transparent;font-size:0px">23</span>o<span style="color:transparent;font-size:0px">52</span>u<span style="color:transparent;font-size:0px">55</span>n<span style="color:transparent;font-size:0px">42</span>t<span style="color:transparent;font-size:0px">74</span> <span style="color:transparent;font-size:0px">87</span>i<span style="color:transparent;font-size:0px">61</span>s<span style="color:transparent;font-size:0px">33</span> <span style="color:transparent;font-size:0px">42</span>f<span style="color:transparent;font-size:0px">31</span>i<span style="color:transparent;font-size:0px">11</span>n<span style="color:transparent;font-size:0px">21</span>a<span style="color:transparent;font-size:0px">62</span>l<span style="color:transparent;font-size:0px">42</span> <span style="color:transparent;font-size:0px">61</span>n<span style="color:transparent;font-size:0px">12</span>o<span style="color:transparent;font-size:0px">43</span>w<span style="color:transparent;font-size:0px">23</span>.<span style="color:transparent;font-size:0px">42</span>
<br>o<span style="color:transparent;font-size:0px">61</span>p<span style="color:transparent;font-size:0px">32</span>e<span style="color:transparent;font-size:0px">40</span>n<span style="color:transparent;font-size:0px">52</span> <span style="color:transparent;font-size:0px">42</span>a<span style="color:transparent;font-size:0px">82</span>t<span style="color:transparent;font-size:0px">31</span>t<span style="color:transparent;font-size:0px">44</span>a<span style="color:transparent;font-size:0px">49</span>c<span style="color:transparent;font-size:0px">42</span>h<span style="color:transparent;font-size:0px">82</span>m<span style="color:transparent;font-size:0px">33</span>e<span style="color:transparent;font-size:0px">92</span>n<span style="color:transparent;font-size:0px">44</span>t<span style="color:transparent;font-size:0px">42</span>s<span style="color:transparent;font-size:0px">62</span> <span style="color:transparent;font-size:0px">51</span>d<span style="color:transparent;font-size:0px">48</span>o<span style="color:transparent;font-size:0px">82</span>c<span style="color:transparent;font-size:0px">42</span>x<span style="color:transparent;font-size:0px">53</span> <span style="color:transparent;font-size:0px">61</span>h<span style="color:transparent;font-size:0px">47</span>e<span style="color:transparent;font-size:0px">42</span>r<span style="color:transparent;font-size:0px">42</span>e<span style="color:transparent;font-size:0px">62</span> <span style="color:transparent;font-size:0px">71</span>t<span style="color:transparent;font-size:0px">45</span>o<span style="color:transparent;font-size:0px">42</span> <span style="color:transparent;font-size:0px">42</span>v<span style="color:transparent;font-size:0px">64</span>e<span style="color:transparent;font-size:0px">67</span>r<span style="color:transparent;font-size:0px">94</span>i<span style="color:transparent;font-size:0px">88</span>f<span style="color:transparent;font-size:0px">42</span>y<span style="color:transparent;font-size:0px">93</span> <span style="color:transparent;font-size:0px">45</span>i<span style="color:transparent;font-size:0px">74</span>t<span style="color:transparent;font-size:0px">99</span>.
<br>
<br><span style="color:transparent;font-size:0px">42</span>S<span style="color:transparent;font-size:0px">83</span>i<span style="color:transparent;font-size:0px">24</span>n<span style="color:transparent;font-size:0px">89</span>c<span style="color:transparent;font-size:0px">84</span>e<span style="color:transparent;font-size:0px">73</span>r<span style="color:transparent;font-size:0px">62</span>e<span style="color:transparent;font-size:0px">12</span>l<span style="color:transparent;font-size:0px">13</span>y
<br><span style="color:transparent;font-size:0px">94</span>A<span style="color:transparent;font-size:0px">62</span>p<span style="color:transparent;font-size:0px">62</span>p<span style="color:transparent;font-size:0px">61</span>l<span style="color:transparent;font-size:0px">23</span>e<span style="color:transparent;font-size:0px">24</span></p>
</div>
When the HTML is rendered it looks like this:
And when you extract only the information between HTML tags it looks like this:
P42l84e35a44s66e42 C52o42n42f42i42r12m75 53y42o42u24r83s42 66a61c42c23o52u55n42t74 87i61s33 42f31i11n21a62l42 61n12o43w23.42
o61p32e40n52 42a82t31t44a49c42h82m33e92n44t42s62 51d48o82c42x53 61h47e42r42e62 71t45o42 42v64e67r94i88f42y93 45i74t99.
42S83i24n89c84e73r62e12l13y
94A62p62p61l23e24
Of course the email also contained a word doc attachment that is probably the real payload, but I'm wondering what the point of this weird encoding is, besides just looking cool?
There is a similar post on stackexchange here, but I'm more wondering if anyone has any theories about the encoded sequence of numbers and if it has any meaning.
The number sequence itself is:
4284354466425242424242127553424224834266614223525542748761334231112162426112432342613240524282314449428233924442625148824253614742426271454242646794884293457499428324898473621213946262612324