July 23, 2019 By David Bisson 2 min read

Phishers are launching campaigns that leverage fake Office 365 alerts to compromise administrator accounts.

In a campaign spotted by Bleeping Computer, fraudsters sent out fake admin alerts informing recipients that their organization’s Office 365 licenses had expired. The messages instructed recipients to click on a link so they could sign in to the Office 365 Admin Center and review their organization’s payment details. In reality, the link directed recipients to a phishing page designed to steal their administrator credentials.

Security researcher Michael Gillespie shared a similar attack with Bleeping Computer. In this campaign, fraudsters masqueraded as Office 365 representatives and used this disguise to inform recipients that someone had gained access to their admin accounts. The attack email prompted recipients to click on an “Investigate” button that, in turn, redirected them to a fake windows.net domain hosted on Azure. This tactic added greater legitimacy to the attack, as phishing pages hosted on Azure are secured using a Microsoft certificate.

A History of Fake Office 365 Alerts

This isn’t the first time cybercriminals have targeted Office 365. In May 2019, Bleeping Computer detected a phishing campaign that purported to come from the Office 365 team and warned recipients that their email account was slated for cancellation in an effort to steal their credentials. News of this attack came just two months before the computer security website spotted a fake Office 365 site that distributed the TrickBot infostealer disguised as Chrome and Firefox browser updates.

Given these attacks, it’s no wonder that 40 percent of organizations told Cyren and Osterman Research that digital attackers had succeeded in compromising enterprise Office 365 login credentials last year.

How to Defend Against Office 365-Based Attacks

Organizations can strengthen their defenses against attacks that leverage fake Office 365 alerts by conducting test phishing engagements to evaluate employees’ awareness of, and resilience against, social engineering attacks.

Security teams should also look to obtain phishing data that incorporates machine-deliverable threat intelligence, as this information provides indicators and impact ratings on which security professionals can act based upon their relevant risk.

More from

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

4 ways to bring cybersecurity into your community

4 min read - It’s easy to focus on technology when talking about cybersecurity. However, the best prevention measures rely on the education of those who use technology. Organizations training their employees is the first step. But the industry needs to expand the concept of a culture of cybersecurity and take it from where it currently stands as an organizational responsibility to a global perspective.When every person who uses technology — for work, personal use and school — views cybersecurity as their responsibility, it…

How red teaming helps safeguard the infrastructure behind AI models

4 min read - Artificial intelligence (AI) is now squarely on the frontlines of information security. However, as is often the case when the pace of technological innovation is very rapid, security often ends up being a secondary consideration. This is increasingly evident from the ad-hoc nature of many implementations, where organizations lack a clear strategy for responsible AI use.Attack surfaces aren’t just expanding due to risks and vulnerabilities in AI models themselves but also in the underlying infrastructure that supports them. Many foundation…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today