Phishing Campaign Abuses Microsoft Customer Voice
Researchers at Avanan warn that a phishing campaign is using Microsoft’s Dynamic 365 Customer Voice feature to send malicious links. Customer Voice is designed to collect feedback from customers, but attackers are using it to send phony links claiming that the recipient has received a voicemail.
“This email comes from the survey feature in Dynamics 365,” the researchers write. “Interestingly, you’ll notice the sending address has ‘Forms Pro’ in it, which is the old name of the survey feature. The email shows that a new voicemail has been received. To the end user, this looks like a voicemail from a customer, which would be important to listen to. Clicking on it is the natural step.”
The link to the fake voicemail comes from a Microsoft domain, so email security products tend to view it as safe.
“This is a legitimate Customer Voice link from Microsoft,” Avanan says. “Because the link is legit, scanners will think that this email is legitimate. However, when clicking upon the ‘Play Voicemail’ button, hackers have more tricks up their sleeves. The intent of the email is not in the voicemail itself; rather, it is to click on the ‘Play Voicemail’ button, which redirects to a phishing link.”
Avanan notes that attackers are increasingly abusing legitimate platforms to bypass email security filters.
“We’ve seen this a lot recently, whether it’s Facebook, PayPal, QuickBooks or more. It is incredibly difficult for security services to suss out what is real and what is nested behind the legitimate link,” the researchers write. “Plus, many services see a known good link and, by default, don’t scan it. Why scan something good? That’s what hackers are hoping for.
This is a particularly tricky attack because the phishing link doesn’t appear until the final step. Users are first directed to a legitimate page–so hovering over the URL in the email body won’t provide protection. In this case, it would be important to remind users to look at all URLs, even when they are not in an email body. These attacks are incredibly difficult to stop for scanners and even harder for users to identify.”
New-school security awareness training can give your organization an essential layer of defense against social engineering attacks.
Avanan has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW