A phishing technique that makes use of Microsoft Sway could attack organizations even if they don’t use the tool, security researchers warn.

Cybercriminals are able to create landing pages that look like legitimate online content and dupe victims into clicking on a malicious URL by hosting them on sway.office.com, according to a post from Avanan.

Given that URL filters tend to trust this domain, the bogus landing pages may go undetected, and they can use Office 365 styling and menus to appear more genuine. Best known as a tool for creating a variety of digital content with a shareable link, Microsoft Sway is available on the Windows 10 app as well as online.

Beware of Urgent Fax and Voicemail Notifications

Researchers said some of the phishing pages include well-known Microsoft product logos, including SharePoint, as well as those from real fax service providers. The latter is important because some of the common tactics to create a sense of urgency around clicking the link for these phishing campaigns include sending messages that a fax or voicemail has been received.

The report showed one instance, for example, where attackers added a timestamp next to a “Fax Received” email message that came from an email address that ended with onmicrosoft.com. The bogus fax, meanwhile, was offered via a link using the sway.office.com domain.

While best practices to combat phishing attacks often include blacklisting worrisome domains, researchers said this probably wouldn’t work in this case since attackers may use several different domains and senders. It may also be unfeasible for those organizations that regularly use Microsoft Sway to block content that use its domain.

This isn’t the first time Sway has been identified as a tool for conducting phishing attacks; Forcepoint researchers published similar findings as far back as October 2018.

Reduce the Risks of Microsoft Sway Phishing Attacks

Microsoft provides an online form where those who come across phishing schemes can send samples for deeper analysis. Beyond that, test phishing engagements will ensure employees are properly trained and acting appropriately to prevent clicking on malicious links by accident or mistake.

Given the risk, however, implementing a model of least privilege will ensure that if someone does manage to use Microsoft Sway to dupe someone, the attackers won’t be able to access an organization’s most critical resources or data.

More from

Why Cybersecurity Risk Assessment Matters in the Banking Industry

When customers put money in a bank, they need to trust it will stay there. Because of the high stakes involved for the customer, such as financial loss, and how long it takes to resolve fraud and potential identity theft, customers are sensitive to the security of the bank as well as fraud prevention measures. Banks that experience high volumes of fraud are likely to lose customers and revenue. The key is to protect customers and their accounts before problems…

What CISOs Should Know About CIRCIA Incident Reporting

In March of 2022, a new federal law was adopted: the Cyber Incident Reporting Critical Infrastructure Act (CIRCIA). This new legislation focuses on reporting requirements related to cybersecurity incidents and ransomware payments. The key takeaway: covered entities in critical infrastructure will now be required to report incidents and payments within specified time frames to the Cybersecurity and Infrastructure Security Agency (CISA). These new requirements will change how CISOs handle cyber incidents for the foreseeable future. As a result, CISOs must…

Will the 2.5M Records Breach Impact Student Loan Relief?

Over 2.5 million student loan accounts were breached in the summer of 2022, according to a recent Maine Attorney General data breach notification. The target of the breach was Nelnet Servicing, a servicing system and web portal provider for the Oklahoma Student Loan Authority (OSLA) and EdFinancial. An investigation determined that intruders accessed student loan account registration information between June and July 2022. The stolen data includes names, addresses, emails, phone numbers and social security numbers for 2,501,324 student loan…

Containers, Security, and Risks within Containerized Environments

Applications have historically been deployed and created in a manner reminiscent of classic shopping malls. First, a developer builds the mall, then creates the various stores inside. The stores conform to the dimensions of the mall and operate within its floor plan. In older approaches to application development, a developer would have a targeted system or set of systems for which they intend to create an application. This targeted system would be the mall. Then, when building the application, they would…