January 14, 2020 By Shane Schick 2 min read

A phishing technique that makes use of Microsoft Sway could attack organizations even if they don’t use the tool, security researchers warn.

Cybercriminals are able to create landing pages that look like legitimate online content and dupe victims into clicking on a malicious URL by hosting them on sway.office.com, according to a post from Avanan.

Given that URL filters tend to trust this domain, the bogus landing pages may go undetected, and they can use Office 365 styling and menus to appear more genuine. Best known as a tool for creating a variety of digital content with a shareable link, Microsoft Sway is available on the Windows 10 app as well as online.

Beware of Urgent Fax and Voicemail Notifications

Researchers said some of the phishing pages include well-known Microsoft product logos, including SharePoint, as well as those from real fax service providers. The latter is important because some of the common tactics to create a sense of urgency around clicking the link for these phishing campaigns include sending messages that a fax or voicemail has been received.

The report showed one instance, for example, where attackers added a timestamp next to a “Fax Received” email message that came from an email address that ended with onmicrosoft.com. The bogus fax, meanwhile, was offered via a link using the sway.office.com domain.

While best practices to combat phishing attacks often include blacklisting worrisome domains, researchers said this probably wouldn’t work in this case since attackers may use several different domains and senders. It may also be unfeasible for those organizations that regularly use Microsoft Sway to block content that use its domain.

This isn’t the first time Sway has been identified as a tool for conducting phishing attacks; Forcepoint researchers published similar findings as far back as October 2018.

Reduce the Risks of Microsoft Sway Phishing Attacks

Microsoft provides an online form where those who come across phishing schemes can send samples for deeper analysis. Beyond that, test phishing engagements will ensure employees are properly trained and acting appropriately to prevent clicking on malicious links by accident or mistake.

Given the risk, however, implementing a model of least privilege will ensure that if someone does manage to use Microsoft Sway to dupe someone, the attackers won’t be able to access an organization’s most critical resources or data.

More from

Unpacking the NIST cybersecurity framework 2.0

4 min read - The NIST cybersecurity framework (CSF) helps organizations improve risk management using common language that focuses on business drivers to enhance cybersecurity.NIST CSF 1.0 was released in February 2014, and version 1.1 in April 2018. In February 2024, NIST released its newest CSF iteration: 2.0. The journey to CSF 2.0 began with a request for information (RFI) in February 2022. Over the next two years, NIST engaged the cybersecurity community through analysis, workshops, comments and draft revision to refine existing standards…

What should Security Operations teams take away from the IBM X-Force 2024 Threat Intelligence Index?

3 min read - The IBM X-Force 2024 Threat Intelligence Index has been released. The headlines are in and among them are the fact that a global identity crisis is emerging. X-Force noted a 71% increase year-to-year in attacks using valid credentials.In this blog post, I’ll explore three cybersecurity recommendations from the Threat Intelligence Index, and define a checklist your Security Operations Center (SOC) should consider as you help your organization manage identity risk.The report identified six action items:Remove identity silosReduce the risk of…

Obtaining security clearance: Hurdles and requirements

3 min read - As security moves closer to the top of the operational priority list for private and public organizations, needing to obtain a security clearance for jobs is more commonplace. Security clearance is a prerequisite for a wide range of roles, especially those related to national security and defense.Obtaining that clearance, however, is far from simple. The process often involves scrutinizing one’s background, financial history and even personal character. Let’s briefly explore some of the hurdles, expectations and requirements of obtaining a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today