A new phishing campaign is exploiting the ongoing uncertainty about company policies related to COVID-19, according to Roger Kay at INKY. The campaign uses emails that purport to come from a company’s HR office informing employees that they’re required to fill out a COVID-19 vaccination status form. Clicking on the link in the email will take the user to a Microsoft Outlook credential phishing page.
“This campaign was able to bypass existing email security in a number of ways,” Kay says. “It sent the lures from legitimate but hijacked email accounts to evade standard security checks. If the recipient clicked through, they were taken to a hijacked web page that impersonated a trusted brand. Because the phishers used a hijacked site, their exploit had not yet appeared on any threat intelligence feed. The sally was effectively a zero-day attack. Now that it’s been discovered and reported, any email security products that reference such feeds can find it, but it’s a little late for the first victims targeted by the campaign.”
Kay also notes that the emails are sent from compromised email accounts, which further added to their legitimacy.
“While the pitches appeared to be local, in fact, they all originated from various legitimate — but hijacked — external accounts,” Kay says. “This legitimacy enabled them to pass standard email authentication (i.e., SPF, DKIM, and DMARC).”
Kay explains that this phishing campaign uses the following tactics:
- “The exploitation of current events — capitalizes on the uncertainty, fear, and urgency related to Covid-19 vaccinations and plans to return to the office
- “Brand impersonation — uses elements of a well-known brand to make an email look as if it came from that company
- “Credential harvesting — occurs when a victim thinks they are logging in to one of their resource sites but is actually entering credentials into a dialogue box owned by the attackers
- “Compromised email accounts — are used by phishers to pass most security software tests, allowing phishing emails to slip past corporate defences and into hapless recipients’ inboxes”
New-school security awareness training can enable your employees to recognize the hallmarks of social engineering attacks.
INKY has the story.
