skip to Main Content

At The Identity Organisation, we're here to help!

Slide Get in Touch With Us We work closely with our clients to understand their goals and then help them develop their plans in accordance with their core requirements. Our success is our clients success. Get in touch with us to uncover and deliver on opportunities that build lasting value. How to find us The Identity Organisation Ltd
Mercury House
19-21 Chapel Street, Marlow,
Bucks, SL7 2HN
Contact Details +44 (0) 1628 308038

Alternatively, fill in our contact form below and one of our consultants will be in touch.

    Your privacy is important to us, and we want to communicate with you in a way which has your consent and which is in line with UK Law on data protection. As a result of a change in UK law on 25th May 2018, by providing us with your personal details you consent to us processing your data in line with current GDPR requirements.

    Here is where you can review our Privacy & GDPR Statement

    To remove consent at any time, please e-mail with the word "unsubscribe" as the subject.

    +44 (0) 1628 308038

    Email Sandboxes Are Detected and Rendered Useless in New Office 365 Phishing Attack

    Email Sandbox

    A new threat tactic is being used to determine if sandbox environments are being used to gain more information about a potential phishing attack, allowing the bad guys to avoid detection.

    We’ve written countless articles about attacks seeking to trick users out of their Office 365 credentials. In nearly every case, it involves redirecting the victim to a fake logon page. Security solutions today that scan web targets from outbound web requests (like those used in these Office 365 scams) typically help protect users by first seeing how the webpage interacts in a protected “sandbox” environment, before allowing the user to connect to the site.

    But a new method of detection avoidance has been found by Microsoft where redirector URLs are used that first detect incoming connections to determine if it’s your sandbox doing the connecting, or your user. If the former, the redirection is pointed towards the legitimate Office 365 page. If the latter, your user may quickly become the next victim.

    And this isn’t even the bad news.

    Despite the fact that the design of the emails used to obfuscate their malicious intent results in some very poorly presented content (see below), the really bad news is your users are still falling for it!

    www.bleepstatic.comimagesnewsu11092922020Phishing email samples(1)

    Source: Microsoft

    What seems obvious to you and me is anything but to your users; they need to be educated via Security Awareness Training about how phishing scams work, the tactics used, and – candidly – how an email that looks like the above needs to be assumed to be a complete sham until proven otherwise.

    Free Phishing Security Test

    Would your users fall for convincing phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

    PST Results

    Here’s how it works:

    • Immediately start your test for up to 100 users (no need to talk to anyone)
    • Select from 20+ languages and customize the phishing test template based on your environment
    • Choose the landing page your users see after they click
    • Show users which red flags they missed, or a 404 page
    • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
    • See how your organization compares to others in your industry

    PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser:

    Back To Top