Threat actors have no want of creativity when it comes to phishing scams. They look for new lures, new subjects and new targets as a means of preying upon organizations and users.

Fortunately, researchers are well aware of this stream of attacks that go beyond phishing emails. Many security professionals spend their time unraveling these advancements in order to keep organizations and users safe. That explains why so many phishing attacks end up making headlines for their methods and how they were caught.

Here are overviews of the techniques used in four notable phishing attacks in the second half of August 2020.

1. Canva Abused for Hosting Files

On Sunday, August 16, KnowBe4 revealed it had come across a phishing email that spoofed a file sharing notification from Sharepoint. This email instructed the recipient to click on an ‘Open’ button embedded in the email.

Once clicked, that button redirected the user to a document or file hosted on graphic design platform Canva. This item prompted the visitor to click on an ‘Access Your Secure Document’ hyperlink. In the event the visitor complied, the attack sent them off to a spoofed Sharepoint login page hosted on Weebly.

2. Corporate VPNs Targeted by Vishers

A few days later, KrebsonSecurity.com disclosed an investigation into a group of phishers-for-hire using vishing, or voice fishing. At the time of reporting, this group had primarily targeted organizations in financial, telecommunications and social media sectors.

The attacks launched by the threat group were unique in that they all started with phone calls to employees working at a targeted organization. In those calls, the attackers masqueraded as someone from IT and informed the employee they were troubleshooting some issues with the organization’s corporate VPN. The malicious actors used that ruse in an attempt to trick the employee into divulging their credentials. This could be done verbally over the phone or by visiting a phishing site created for the attacks.

3. Brokers’ Info Stolen to Create Phishing Websites

The Financial Industry Regulatory Authority (FINRA) published Regulatory Notice 20-30 on August 20. FINRA explains it received several reports from members’ firms indicating fraudsters used representatives’ information to create fake websites. Most commonly, those websites used a targeted representative’s name as the domain. They also included a picture of the representative along with details about their employment history.

Those responsible for creating these imposter sites didn’t stop there. Per FINRA’s bulletin, the fraudsters created contact forms that prompted visitors to submit their personal information including their names, email addresses and phone numbers. FINRA also said that it received reports of fraudsters having called customers and directed them to visit the fake sites.

4. Low-Key Scam Targeting Employees’ OWA Credentials

Around that same time, Sophos came across a ‘low-key’ phishing scam campaign. This operation began with an attack email that appeared to be an automated message from their own email account. This message informed them that several incoming messages had failed to arrive in their inbox. It then prompted them to visit a company-assigned Outlook Web Access (OWA) portal by clicking on a link that included the company’s name in the URL.

The only problem was the link contained a different destination than what was displayed in the hyperlinked text. Instead, it redirected the user to a temporary cloud web storage URL hosting a fake OWA login portal. Upon receiving a user’s credentials, the attack sent the victim to a legitimate OWA page.

How to Defend Against Phishing Scams

The attacks described above highlight the need for organizations to defend against phishers. They can do this by preventing users from accessing high-value assets, unless they’re critical to their work, and monitoring user behavior for suspicious activity. Simultaneously, they should test their employees’ awareness of phishing attacks on an ongoing basis as well as continuously monitor for and proactively purchase typo-squatting domains that might be impersonating their web resources.