Skip to main content

Microsoft Teams Phishing Attack Targets Office 365 Users

 


Up to 50,000 Office 365 users are being targeted by a phishing campaign that purports to notify them of a “missed chat” from Microsoft Teams.

Researchers are warning of a phishing campaign that pretends to be an automated message from Microsoft Teams. In reality, the attack aims to steal Office 365 recipients’ login credentials.

Teams is Microsoft’s popular collaboration tool, which has particularly risen in popularity among remote workforces during the pandemic — making it an attractive brand for attackers to impersonate. This particular campaign was sent to between 15,000 to 50,000 Office 365 users, according to researchers with Abnormal Security on Thursday.

“Because Microsoft Teams is an instant-messaging service, recipients of this notification might be more apt to click on it so that they can respond quickly to whatever message they think they may have missed based on the notification,” said researchers in a Thursday analysis.


The initial phishing email displays the name “There’s new activity in Teams,” making it appear like an automated notification from Microsoft Teams.

As seen in the picture below, the email tells recipient that their teammates are trying to reach them, warning them they have missed Microsoft Team chats and showing an example of a teammate chat that asks them to submit something by Wednesday of next week.

Erin Ludert, data scientist at Abnormal Security, told Threatpost researchers suspect attackers are using more of a “spray” tactic here, as the employee referenced in the chats doesn’t appear to be an employee of the company that received the attack.

To respond, the email urges the recipient to click on the “Reply in Teams” button — However, this leads to a phishing page.

“Within the body of the email, there are three links appearing as ‘Microsoft Teams’, ‘(contact) sent a message in instant messenger’, and ‘Reply in Teams’,” according to researchers. “Clicking on any of these leads to a fake website that impersonates the Microsoft login page. The phishing page asks the recipient to enter their email and password.”

Researchers said that the phishing landing page also looks convincingly like a Microsoft login page with the start of the URL containing “microsftteams.” If recipients are convinced to input their Microsoft credentials into the page, they are unwittingly handing them over to attackers, who can then use them for an array of malicious purposes — including account takeover.

With the ongoing pandemic, worries about cyberattackers leveraging enterprise friendly collaboration brands like Microsoft Teams, Zoom and Skype have been piqued. In May, a convincing campaign that impersonated notifications from Microsoft Teams in order to steal the Office 365 credentials of employees circulated, with two separate attacks that targeted as many as 50,000 different Teams users.

Microsoft is top of the heap when it comes to hacker impersonations — with Microsoft products and services featuring in nearly a fifth of all global brand phishing attacks in the third quarter of this year. Attackers are also using sophisticated tactics — including visual CAPTCHAS to target Office 365 users and token-based authorization methods.


Originally published at https://threatpost.com on October 22, 2020.

Comments

Post a Comment

Popular posts from this blog

Ex-Twitter employees accused of spying for Saudi Arabia

Two former employees of Twitter have been charged in the US with spying for Saudi Arabia. The charges, unsealed on Wednesday in San Francisco, allege that Saudi agents sought personal information about Twitter users including known critics of the Saudi government. Court documents  named the two as Ahmad Abouammo, a US citizen, and Ali Alzabarah, from Saudi Arabia. A third person, Saudi citizen Ahmed Almutairi, is also accused of spying. The New York Times says it is the first time that Saudi citizens have been charged with spying inside the United States. What are the charges? The charges allege Mr Almutairi acted as an intermediary between the two Twitter employees and Saudi officials. Ahmad Abouammo appeared in a Seattle court on Wednesday and was remanded in custody pending another hearing due on Friday. He is also charged with falsifying documents and making false statements to the FBI. Mr Abouammo is said to have left his job as a media partnership manager ...
Post a Comment
Read more

Google teams up with security companies to catch bad apps before they hit the Play Store

It’s calling the partnership the ‘App Defense Alliance’ Google announced  today that it’s teaming up with three security companies to help identify malicious apps before they’re published on the Play Store and can potentially do harm to Android users. The company is calling this partnership the App Defense Alliance. Android is on over 2.5 billion devices, according to Google, and the company says that makes the platform “an attractive target” for abuse. That abuse can take the form of hidden malware or secret code designed to spy and siphon away sensitive user data. This seems to be particularly true of the Play Store — over the past year or so, Google has had to take  action   against   multiple   developers  for releasing apps on the Play Store using scammy ad practices. By forming the App Defense Alliance, Google is enlisting security companies ESET, Lookout, and Zimperium to help scan for bad apps before they hit the Play Store in the first p...
Post a Comment
Read more

Babuk ransomware is back, uses new version on corporate networks

  After announcing their exit from the ransomware business in favor of data theft extortion, the Babuk gang appears to have slipped back into their old habit of encrypting corporate networks. The criminals are currently using a new version of their file-encrypting malware and have moved the operation to a new leak site that lists a handful of victims. Gang’s still in the game The Babuk ransomware group became known at the beginning of the year but the gang says that their attacks had started in mid-October 2020, targeting companies across the world and demanding ransoms typically between $60,000 and $85,000 in bitcoin cryptocurrency. In some cases, victims were asked hundreds of thousands for data decryption. One of their most publicized victims is the Washinton DC’s Metropolitan Police Department (MPD). This attack likely pushed the threat actor into announcing its retirement from the ransomware business only to adopt another extortion model that did not include encryption....
Post a Comment
Read more