Microsoft Teams: The New Phishing Battlefront – How Attackers Are Exploiting Trusted Platforms
Attackers are abusing Microsoft Teams to send phishing messages, according to researchers at AT&T Cybersecurity.
“While most end users are well-acquainted with the dangers of traditional phishing attacks, such as those delivered via email or other media, a large proportion are likely unaware that Microsoft Teams chats could be a phishing vector,” the researchers write.
“Most Teams activity is intra-organizational, but Microsoft enables External Access by default, which allows members of one organization to add users outside the organization to their Teams chats. Perhaps predictably, this feature has provided malicious actors a new avenue by which to exploit untrained or unaware users.”
In the case observed by AT&T Cybersecurity, the attackers used a compromised domain to send the messages.
“An important detail to note here is the “.onmicrosoft[.]com” domain name,” the researchers write. “This domain, by all appearances, is authentic and most users would probably assume that it is legitimate. OSINT research on the domain also shows no reports for suspicious activity, leading the MDR SOC team to believe the username (and possibly the entire domain) was likely compromised by the attackers prior to being used to launch the phishing attack.”
In this case, the attackers sent users a malicious file with a double extension designed to trick users into thinking its a PDF file. This file, when opened, would install the DarkGate malware.
“The MDR SOC team continued to drill down on the phished users to determine the precise nature of the attack,” the researchers explain. “They subsequently discovered three users who had downloaded a suspicious double extension file. The file was titled ‘Navigating Future Changes October 2023.pdf.msi.’ Double extension files are commonly used by attackers to trick users into downloading malicious executables, as the second extension, .msi in this case, is usually hidden by the filesystem. The user believes they are downloading a PDF for business use, but instead receives a malicious installer.”
New-school security awareness training can give your employees a healthy sense of suspicion so they can recognize social engineering tactics. KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
AT&T Cybersecurity has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW