Skip to main content

Microsoft Teams Phishing Attack Targets Office 365 Users

 


Up to 50,000 Office 365 users are being targeted by a phishing campaign that purports to notify them of a “missed chat” from Microsoft Teams.

Researchers are warning of a phishing campaign that pretends to be an automated message from Microsoft Teams. In reality, the attack aims to steal Office 365 recipients’ login credentials.

Teams is Microsoft’s popular collaboration tool, which has particularly risen in popularity among remote workforces during the pandemic — making it an attractive brand for attackers to impersonate. This particular campaign was sent to between 15,000 to 50,000 Office 365 users, according to researchers with Abnormal Security on Thursday.

“Because Microsoft Teams is an instant-messaging service, recipients of this notification might be more apt to click on it so that they can respond quickly to whatever message they think they may have missed based on the notification,” said researchers in a Thursday analysis.


The initial phishing email displays the name “There’s new activity in Teams,” making it appear like an automated notification from Microsoft Teams.

As seen in the picture below, the email tells recipient that their teammates are trying to reach them, warning them they have missed Microsoft Team chats and showing an example of a teammate chat that asks them to submit something by Wednesday of next week.

Erin Ludert, data scientist at Abnormal Security, told Threatpost researchers suspect attackers are using more of a “spray” tactic here, as the employee referenced in the chats doesn’t appear to be an employee of the company that received the attack.

To respond, the email urges the recipient to click on the “Reply in Teams” button — However, this leads to a phishing page.

“Within the body of the email, there are three links appearing as ‘Microsoft Teams’, ‘(contact) sent a message in instant messenger’, and ‘Reply in Teams’,” according to researchers. “Clicking on any of these leads to a fake website that impersonates the Microsoft login page. The phishing page asks the recipient to enter their email and password.”

Researchers said that the phishing landing page also looks convincingly like a Microsoft login page with the start of the URL containing “microsftteams.” If recipients are convinced to input their Microsoft credentials into the page, they are unwittingly handing them over to attackers, who can then use them for an array of malicious purposes — including account takeover.

With the ongoing pandemic, worries about cyberattackers leveraging enterprise friendly collaboration brands like Microsoft Teams, Zoom and Skype have been piqued. In May, a convincing campaign that impersonated notifications from Microsoft Teams in order to steal the Office 365 credentials of employees circulated, with two separate attacks that targeted as many as 50,000 different Teams users.

Microsoft is top of the heap when it comes to hacker impersonations — with Microsoft products and services featuring in nearly a fifth of all global brand phishing attacks in the third quarter of this year. Attackers are also using sophisticated tactics — including visual CAPTCHAS to target Office 365 users and token-based authorization methods.


Originally published at https://threatpost.com on October 22, 2020.

Comments

Popular posts from this blog

Scraped data of 500 million LinkedIn users being sold online, 2 million records leaked as proof | CyberNews

  Updated on 07/04: We updated our personal data leak checker database with more than 780,000 email addresses associated with this leak . Use it to find out if your LinkedIn profile has been scraped by the threat actors. Days after a massive Facebook data leak made the headlines, it seems like we’re in for another one, this time involving LinkedIn. An archive containing data purportedly scraped from 500 million LinkedIn profiles has been put for sale on a popular hacker forum, with another 2 million records leaked as a proof-of-concept sample by the post author. The four leaked files contain information about the LinkedIn users whose data has been allegedly scraped by the threat actor, including their full names, email addresses, phone numbers, workplace information, and more. To see if your email address has been exposed in this data leak or other security breaches, use our personal data leak checker with a library of 15+ billion breached records . While users on the hacker foru...

[Update] Twitter down, not working on Android | How to fix Twitter crashing issue | DigiStatement

In our earlier posts, we reported that a lot of users are posting about the crashing issue with the Twitter app on the Android platform. Some users posted that the app is not opening after updating it to the latest version on Google Play Store, while some reported that they are using the older version of the Twitter app and still facing the crashing issue. Well, Twitter officially acknowledged the issues with the Android app of Twitter and posted an update with the official account of Twitter Support. In the tweet, Twitter also suggested its users to not update and download the latest version of the app. You can check out the official tweet below. How to fix Twitter crashing issue - If you are still using the older version of the Twitter app, first you need to turn off the auto-update feature in the Google Play Store. For this, go to the Play Store app then head to Settings > Auto-Update Apps > Don’t Auto-Update Apps . You can enable this feature later, as it will s...

Facebook bows to Singapore's 'fake news' law

Facebook has added a correction notice to a post that Singapore’s government said contained false information. It is the first time Facebook has issued such a notice under the city-state’s controversial “fake news” law. Singapore claimed the post, by fringe news site States Times Review (STR), contained “scurrilous accusations”. The note issued by the social media giant said it “is legally required to tell you that the Singapore government says this post has false information”. Facebook’s addition was embedded at the bottom of the original post, which was not altered. It was only visible to social media users in Singapore. Singapore passes controversial fake news law Concern over Singapore’s anti-fake news law Singapore: What you need to know In an emailed statement to the BBC, Facebook said it had applied a label to a post “determined by the Singapore government to contain false information”, as required under the “fake news” law. The company — which has its Asia ...