WARNING! Sneaky Phishing Campaign Targets Office 365 Users
A new phishing campaign that is capable of bypassing current anti-phishing measures has been discovered by the Microsoft Security intelligence team. The campaign, directed at Office 365 users, is more crafty and advanced than previous ones and it involves the use of spoofed sender email addresses.
Microsoft issued out alerts after discovering the active campaign targeted at a lot of organizations using Office 365 products. The phishing features convincing emails and advanced techniques designed to bypass phishing detection systems.
Hackers behind the campaign used an Office 365 phishing page hosted on a Google cloud web app and combined this with a compromised SharePoint website through which login credentials are stolen.
Phishing Revisited
Phishing generally involves impersonating a trustworthy entity or person to victims with the aim of acquiring sensitive information, login details, credit cards, and company funds.
Social media websites, banks, IT admins, and high-ranking executives are often the object of impersonation. Phishing is reported to cost businesses billions of dollars per year.
Forms of phishing threats used by cybercriminals including spear phishing, session hijacking, email phishing, link manipulation, and web page or web-based phishing.
Phishing is used by cybercriminals to compromise organizations’ systems in order to install malware, steal business data and funds from businesses, and create data breaches. Due to its frequency in cyberattacks, several anti-phishing tools have been developed over the years to protect organizations.
However, attackers continue to innovate and use new and modified phishing methods to evade business security and get a foothold on target systems. This new phishing campaign discovery is part of the ongoing struggle between cyber security professionals and cybercriminals.
Phishing Campaign Details
1) According to Microsoft Security Team , the newly discovered phishing campaign uses legitimate-looking sender email addresses. Thus, the email sender’s address is insufficient to confirm the real identity of the sender.
2) The ongoing phishing campaign also uses spoofed send addresses containing username and domain to impersonate legitimate services and bypass email filters.
3) The original sender address of the discovered email includes a variation of the word “referral” and .com as top-level domain ( TLD ) for spoofing for more persuasive appeal.
4) The group behind this attack uses fake email display names of legitimate services to deceive victims into visiting the included link.
5) The phishing email was designed as a “file share” request purportedly for official reports such as “bonuses” and “pricebooks” in spreadsheet format.
6) Convincing Microsoft logos and branding images are spread throughout the document to convince victims of their origin.
7) Inside the email is one phishing link to Google storage resources that eventually redirects victims to Google App Engine hosted web applications.
8) A second hidden link is embedded in the main phishing page and it links to a compromised SharePoint site. The URLs require visitors to login in order to access them which is another layer of evading email sandboxes.
Protect Your Organization
It is recommended that you frequently enroll your employees in phishing awareness training or cybersecurity training. For this particular phishing campaign, employees should be made aware of the nature of the phishing attack and how to recognize and report them.
In addition, your company should deploy spam filters at the network and system layer to block phishing attempts, regularly change passwords, and increase your browser security settings to block malicious URLs.
Get in touch with SDTEK today to secure your business against phishing attacks.
The post WARNING! Sneaky Phishing Campaign Targets Office 365 Users appeared first on SDTEK | San Diego, CA.
