Cloaking Malicious Web Content Delivery

The talk introduces browser fingerprinting by comparing it to the guessing game Guess Who: a set of attributes collected from a browser can narrow it down to a single unique identity. One example given is canvas fingerprinting, where an image rendered in the browser varies with its hardware and settings, and the resulting data is sent back to a server.

The speaker then moves to cloaking, where a server changes what it delivers based on a visitor's fingerprint. An attacker could target a specific browser version or even a particular person, showing harmless content to everyone else and the malicious payload only to the chosen device. A decoy page can also waste an analyst's time, because the investigator may look at the benign content, decide the lead is bad, and never receive the real payload.

The main takeaway is that analysts should not assume every visit returns the same content, and that using different browser profiles may help reveal what is actually served. The speaker also points out that threat intelligence has little precise terminology for this behaviour, since existing tags describe only basic checks such as a browser version. The call is to share examples and, if the pattern recurs, to work toward a shared taxonomy.