Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

Microsoft 365 users targeted by major phishing campaign

A fish hook is lying across a computer keyboard, representing a phishing attack on a computer system

Someone is targeting high-profile individuals such as C-level executives with super-tailored phishing emails, cybersecurity researchers from Proofpoint have claimed.

The company says it has recently unovered a major campaign whose goal is to steal Microsoft 365 accounts leveraging a known phishing-as-a-service provider known as EvilProxy. 

This tool costs around $400 a month and was used to send some 120,000 phishing emails to more than a hundred organizations in the past couple of months. In this particular campaign, the threat actors are stealing login credentials and multi-factor authentication (MFA) codes by redirecting the users multiple times until they land on the specially crafted, malicious landing page. That not only allows them to steal the needed information, but also to evade detection.

Turkish threat actors?

"In order to hide the user email from automatic scanning tools, the attackers employed special encoding of the user email, and used legitimate websites that have been hacked, to upload their PHP code to decode the email address of a particular user," Proofpoint said in its writeup.

"After decoding the email address, the user was forwarded to the final website – the actual phishing page, tailor-made just for that target’s organization."

The researchers also speculate that the attackers are from Turkey, because users with Turkish IP addresses are redirected to the legitimate site immediately and the entire operation gets called off.

The researchers also determined that the entire operation was very precise. Targets that were “lower” in an organization’s hierarchy were ignored, or de-prioritized. Instead, high-position individuals, “VIP” targets, were more attractive. Almost two in five (39%) of the breached accounts were C-Suite, almost a tenth (9%) were CEOs and vice presidents, and almost a fifth (17%) were CFOs. 

The rest were not executives, but still individuals with access to sensitive information, or financial assets. 

The only way to defend against these attacks is to make sure the targets don’t fall for the trap and click on the link, or download the attachment, sent in these emails. FIDO-based physical keys can also help, the researchers concluded.

Via: BleepingComputer

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.