July 23, 2019 By David Bisson 2 min read

Phishers are launching campaigns that leverage fake Office 365 alerts to compromise administrator accounts.

In a campaign spotted by Bleeping Computer, fraudsters sent out fake admin alerts informing recipients that their organization’s Office 365 licenses had expired. The messages instructed recipients to click on a link so they could sign in to the Office 365 Admin Center and review their organization’s payment details. In reality, the link directed recipients to a phishing page designed to steal their administrator credentials.

Security researcher Michael Gillespie shared a similar attack with Bleeping Computer. In this campaign, fraudsters masqueraded as Office 365 representatives and used this disguise to inform recipients that someone had gained access to their admin accounts. The attack email prompted recipients to click on an “Investigate” button that, in turn, redirected them to a fake windows.net domain hosted on Azure. This tactic added greater legitimacy to the attack, as phishing pages hosted on Azure are secured using a Microsoft certificate.

A History of Fake Office 365 Alerts

This isn’t the first time cybercriminals have targeted Office 365. In May 2019, Bleeping Computer detected a phishing campaign that purported to come from the Office 365 team and warned recipients that their email account was slated for cancellation in an effort to steal their credentials. News of this attack came just two months before the computer security website spotted a fake Office 365 site that distributed the TrickBot infostealer disguised as Chrome and Firefox browser updates.

Given these attacks, it’s no wonder that 40 percent of organizations told Cyren and Osterman Research that digital attackers had succeeded in compromising enterprise Office 365 login credentials last year.

How to Defend Against Office 365-Based Attacks

Organizations can strengthen their defenses against attacks that leverage fake Office 365 alerts by conducting test phishing engagements to evaluate employees’ awareness of, and resilience against, social engineering attacks.

Security teams should also look to obtain phishing data that incorporates machine-deliverable threat intelligence, as this information provides indicators and impact ratings on which security professionals can act based upon their relevant risk.

More from

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Can memory-safe programming languages kill 70% of security bugs?

3 min read - The Office of the National Cyber Director (ONCD) recently released a new report, “Back to the Building Blocks: A Path Toward Secure and Measurable Software." The report is one of the first major announcements from new ONCD director Harry Coker and makes a strong case for adopting memory-safe programming languages. This new focus stems from the goal of rebalancing the responsibility of cybersecurity and realigning incentives in favor of long-term cybersecurity investments. Memory-safe programming languages were also included as a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today