Microsoft 365 Users are Once Again the Target of Phishing Scams using Fake Voice Mail Messages
Using a simple email containing a voice mail attachment, an ingenious phishing attack captures credentials while keeping track of the domains being attacked.
It’s no surprise that Microsoft continues to be a brand used as part of credential-harvesting attacks, as the accounts compromised provide threat actors with access to a legitimate email address. So, this latest phishing scam identified by security researchers at Zscaler’s ThreatLabz first uses Zscaler themselves as the initial brand impersonated, and then spoofs a Microsoft 365 logon page to capture credentials.
But what makes this attack interesting is the use of multiple brand impersonation efforts, a fake voice mail message, and a unique tracking method used by the cybercriminals.
The phishing email first uses a “From” email address that aligns with the victim organization. The voice mail attachment uses a music note icon to throw off the recipient victim, but actually is an HTML attachment.
The HTML document serves as a URL redirector that points the victim to a malicious URL unique to the victim organization. According to Zscaler, the redirection URL consists of the following parts:
Source: Zscaler
A CAPTCHA check is used to evade URL analysis told, with the final part of the attack being the spoofed Microsoft 365 logon page.
This attack demonstrates the sophisticated efforts cybercriminals take to keep attacks from being detected and to trick users into falling victim to such scams. Security Awareness Training is an effective tool that helps users understand the methods these attacks use to fool them, empowering the user to remain vigilant when interacting with suspicious emails like the one identified by Zscaler.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW