Phishing Attacks Exploits the Open Enrollment Period
A phishing campaign is impersonating HR to target employees who are making annual insurance changes during the open enrollment period, according to researchers at Abnormal Security.
The attackers are using legitimate notifications from Dropbox to send phishing messages, asking recipients to view a document on Dropbox regarding annual salary increases and open enrollment elections.
If a user clicks the link, they’ll be taken to a Dropbox document containing another link that will redirect them to a spoofed Microsoft login page designed to steal their credentials.
“Upon logging in, they can view the document, which features a combination of impersonated Microsoft and Docusign branding to give the semblance of legitimacy,” the researchers write.
“It also includes a note stating the file ‘contains sensitive information that has been encrypted’ in an attempt to further reinforce the pretext that the document was really sent from the HR department. When the target clicks on either ‘REVIEW DOCUMENT’ or ‘DOWNLOAD DOCUMENT,’ they are redirected to a spoofed Microsoft OneDrive portal and prompted to provide their Microsoft login credentials.”
Since both the email and the link come from Dropbox, the messages are unlikely to be flagged as malicious.
“As previously mentioned, the initial email is indistinguishable from an authentic Dropbox notification because everything about it is legitimate—except the intent behind it,” Abnormal Security explains. “Further, unlike the vast majority of phishing attacks, the malicious link isn’t contained within the email.
It exists within a separate document hosted on a genuine file-hosting service, and it’s only after the target leaves the email environment and engages with the shared file that they’re exposed to the phishing link.”
New-school security awareness training can give your organization an essential layer of defense against social engineering attacks. KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Abnormal Security has the story.
BreachSim
Free downloadable software tool
How easy is it for bad actors to penetrate your system and exfiltrate your data? Pinpoint vulnerabilities, take action and build stronger cyber defenses with BreachSim, a free downloadable software tool from KnowBe4. Based on techniques outlined in the MITRE Att&CK framework, BreachSim launches 12+ data exfiltration scenarios to uncover the stark reality of what happens when employees unknowingly fall for an attack.
How BreachSim works:
- 100% harmless simulation of real breach and data exfiltration attacks
- Provides secure .txt, .doc, and .bmp test files for the simulation
- Tests 12+ realistic data exfiltration scenarios following the MITRE Att&CK framework
- Just download the installer, upload the secure test files, and run
Results in a few minutes!
PS: Don’t like to click on redirected buttons? Cut and paste this link in your browser: https://info.knowbe4.com/breached-password-test-partner?partnerid=001a000001lWEoJAAW