Dodgy New Phishing Platform Targets Microsoft 365 Accounts at Financial Firms

Analysis of the latest phishing-as-a-service (PhaaS) platform ONNX Store highlights just how successful these platforms can be.

Security analysts at threat intelligence vendor Eclectic IQ have been tracking ONNX Store, noting it’s a rebranded evolution of the Caffeine PhaaS platform. According to analysis, ONNX has been used to target financial institutions, “including banks, private funding firms and credit union service providers across the EMEA and AMER regions.”

This platform uses a combination of socially-engineered phishing emails, QR codes contained within PDF attachments, impersonated Microsoft 365 authentication pages hosted on bulletproof hosting services, proxied MFA, and encrypted JavaScript code to avoid detection.

Eclectic IQ mapped out all the services, websites, bots and more used as by this sophisticated platform:

Source: Electric IQ

It’s a rather elaborate setup that should have organizations worried. Something this advanced, which takes into account just about every way a user or security solution could detect it’s a phishing attack, is troublesome.

However, the one element of the attack that even ONNX can’t mimic perfectly is the phish itself.  It requires the recipient to believe they need to open a PDF attachment and then use their mobile phone to scan the QR code to read the document.

Users that undergo continual security awareness training will realize when first receiving such an email that it’s unexpected and – therefore – suspect to begin with. 

KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

---

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

Here’s how it works:

• Immediately start your test for up to 100 users (no need to talk to anyone)
• Select from 20+ languages and customize the phishing test template based on your environment
• Choose the landing page your users see after they click
• Show users which red flags they missed, or a 404 page
• Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
• See how your organization compares to others in your industry

PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW