Cybercriminals have been taking advantage of virtually every aspect of the coronavirus to try to increase business. Among other consequences, the need to quarantine and work from home has triggered a surge in demand for virtual meeting and video chatting apps, including the business-oriented Microsoft Teams. A new phishing campaign discovered by security provider Abnormal Security is exploiting the greater use of Teams as a way to hijack Microsoft account credentials.
SEE:
In a blog post published on Friday, Abnormal Security found a series of convincing emails designed to spoof notification messages from Microsoft Teams.
In one campaign, the phishing email includes a link to a document on a domain used by a legitimate email marketing provider for hosting content for marketing campaigns. In the document is an image that prompts users to sign in to their Microsoft Teams account. But, if someone clicks on this image, a malicious page impersonating the Microsoft Office login site appears for the purpose of capturing the user’s credentials.
In another campaign, the user is redirected to a page hosted on YouTube and is then redirected twice more until reaching a Microsoft page phishing for login credentials. The attackers use multiple URL redirects both to conceal the actual URL and to try to evade the malicious link filtering employed by email security products.
The first campaign started on April 14 and went on for two days but hasn’t been since since, according to Kenneth Laio, vice president of Cybersecurity Strategy at Abnormal Security. The second campaign began on April 29, lasted a few hours, and has not been recorded since then.
The phishing emails were sent to Abnormal customers in such industries as energy, retail, and hospitality, Laio said. However, the attacks weren’t targeted to any specific company or industry and, in fact, were designed in a generic way so they could be launched against anyone.
The landing pages that host the phishing pages were created to look just like the real Microsoft pages. The images were copied from actual Microsoft notifications and emails, according to Abnormal Security. Plus, the sender email comes from a domain called “sharepointonline-irs.com,” which may look legitimate at first glance, but is not registered either by Microsoft or the IRS.
The images can be especially convincing on a mobile device where they take up most of the content on the screen. Further, users who are accustomed to notifications from Microsoft and other vendors might fail to investigate the messages and simply take the bait. Since Microsoft Teams is linked to Microsoft 365 and Office 365, any credentials stolen in the scam could be used to sign into other Microsoft accounts and services.
To help organizations defend themselves and their employees from these Microsoft Teams phishing scams, Laio offers two pieces of advice.
“We would advise organizations and their employees to double-check the sender name and address for messages or notifications coming from Microsoft Teams,” Laio said. “For both campaigns, the sender names are innocuous (‘chat content’ and ‘work flow’), but the email addresses that they are sent from have no relation to Microsoft, Microsoft Teams, or the organization itself.
“In addition, we would advise everyone to always double check the web page’s URL before signing in. Attackers will often hide malicious links in redirects or host them on separate websites that can be reached by safe links. This allows them to bypass link scanning within emails by traditional email security solutions.”
