All 200 Million Office 365 Users at Risk by a New Global Spear Phishing Attack Spoofing Microsoft.com

A new spear phishing campaign appearing to come from a microsoft.com email address is targeting organizations in critical industries that use Office 365 for email to steal credentials.

A recent attack was spotted by researchers at security vendor Ironscales attacking Office 365 accounts belonging to organizations primarily in financial services, healthcare, insurance, manufacturing, utilities, and telecom sectors. This relatively simple attack appears to come from no-reply [at] microsoft.com informing the potential victim that certain email messages have been quarantined and that the victim needs to review the messages and determine whether to reclaim them or delete them. According to Ironscales, the language used in the phishing email is designed to create a sense of urgency – a common element in most scams.

Upon clicking the provided link, users are taken to a spoofed Office 365 logon page where credentials are captured and stolen.

According to Dark Reading’s article on the attack, a Microsoft spokesperson is quoted as saying “Contrary to claims in the third party report, Office 365 has rich in-built controls to block domain spoofing emails and enforces DMARC checks. We encourage all customers to make sure they have deployed the latest security controls in Office 365, enabled multi-factor authentication for Office 365, and train their end users to observe caution when clicking on links from unknown senders."

But given that Ironscales customers are seeing this attack, it’s evident that some are getting through to a user’s Inbox.

What’s needed is to educate users via new school Security Awareness Training on what elements of an unsolicited email should trigger their sense of suspicion. In this case, the urgency denoted to simply review some emails that may or may not be important.