An advanced Microsoft Office 365 phishing campaign is being launched at C-level executives, executive assistants, and financial departments.
Some of these attacks see newly-appointed, unannounced CEO’s as victims. In these cases, attackers try to take advantage of the executives during their transition period to gain unauthorized access to the account.
Attackers try to compromise any company account or a 3rd party partner and then use collected sensitive information to create more sophisticated attacks to phish C-level executives.
This campaign began in early December 2020 and is still ongoing as of March 2021. The attackers are leveraging phishing toolkits and many sophisticated methods.
Most of the phishing emails are sent from addresses with Microsoft-themed sender domains, with properly configured SPF records and are made to look like messages from the company, carrying fake alerts about “Important Service Changes”, “Important Security Policy Update”, etc.
The majority of the targeted email accounts used the format first name.last name@company domain, making full names in the attachments easy to automate. But even in cases where only initials appeared in the email address, the attackers still included the victim’s full name in the PDF attachment. This suggests the threat actors conducted additional prior research to carefully carry out spear phishing attacks.
Through malicious attachments, the victim is sent to a spoofed Microsoft-looking themed webpage with a fake Office 365 login page. If the victim enters their account credentials into the phishing portal, the attacker can then verify it was a valid Office 365 address. If after the victim enters their credentials, the victim may simply be redirected to the legitimate sign-in website like nothing ever happened.
How to Protect Yourself
Sophisticated phishing attacks are hard to detect with typical tools and methods because they do not use malware or malicious URLs that can be detected by antivirus. While it is important that you always use updated end-point protection and antivirus, mitigating this threat is hard. Here are some best practices:
- End-user training, awareness, and education is critical so end-users know to verify a request as legitimate and stay alert for unexpected emails with links or attachments. For example, employees should be on the alert for poor spelling and grammar and spoofed app names, domain URLs and email addresses.
- Implement two-factor authentication (2FA) for email. This is one of the best defences against phishing, because even if the attacker steals a user’s credentials, they won’t be able to gain access without the second factor.
- Configure your email to filter out suspicious looking phishing emails. Depending on your email filter, this may be turned on by default.
- Prohibit employees from being able to navigate to sites not whitelisted via a web filter. If you have a web filter, have your network administrator or authorized IT professional configure it to prohibit users from accessing unsafe and spoofed websites.
Node Prevent
When you purchase one of our cyber insurance policies we include Node Prevent, a free service with employee training, how to implement best practices and threat alerts such as these.
