Microsoft Warns of New Phishing-Turned-Vishing-Turned-Phishing Attack Aimed at Installing Ransomware
In what appears to be a phishing attack that includes a mix of emails and phone calls, Microsoft reminds us to be wary of only opening emails and attachments from known contacts.
Perhaps taking a page from the recent Amazon-themed credit card scam that leverages vishing instead of malicious links, Microsoft has put out a warning of a new attack that starts out as a fake payment notification. The “call center” staffers inform the victim caller of a need to fill out a form, quicky sending over a password-protected zip file that actually contains a malicious Word doc used to infect endpoints with ransomware.
The scam uses the following path, according to Microsoft:
Source: Microsoft Security Intelligence via Twitter
What makes this scam so interesting is the fact that users must be fooled three times:
- That the initial fake invoice is real and that they must call to cancel it
- That the call center support team is real and that an emailed Word doc (instead of a web form) is the means to cancel the payment
- That a Word doc would be emailed inside of a zip file that sits behind a password
None of this sounds very customer-friendly – which should set off some red flags for users with any level of vigilance in place.
It’s stories of users falling for attacks like these that make it critical for organizations to put Security Awareness Training in place to educate users on various types of email attacks, methods used to install software or steal credentials, and the need for the user themselves to play a part in the organization’s security.
I’d file this attack in the “C’mon… really? People fall for that?” category, which only helps make my point about every organization needing proper security awareness training.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW