Hunt: Unit 42 tracked three phishing kits that hide the lure in images, HTML5 canvas and SVG so URL and static HTML scanners see almost no text
- Hunt / detect: pages with almost no visible text or
<input>tags that still show a big 'Continue verification' or receipt preview; HTML that loads PDF.js-style modules then draws a large canvas; SVGs whose path data encodes a QR grid; runtime browser analysis / screenshot OCR rather than DOM string matches alone. - Controls: block or sandbox unexpected HTML attachments and untrusted collaboration-preview links; require phishing-resistant MFA so a captured session from a QR or AiTM page is harder to reuse.
Sources: Unit 42 timely threat intel: Three Phishing Campaigns Using Graphics-Based Lures (Nov 4) · Unit 42 on X (Nov 5)