Researchers at Abnormal Security warn that a phishing campaign is trying to steal LogMeIn remote desktop credentials. The attackers are sending phishing emails that purport to come from LogMeIn, and they pretend to inform the recipient of an urgent security update.
The emails contain a link that appears to be a URL pointing to LogMeIn’s legitimate website, but this is actually anchor text (clickable text) posing as a URL, and the link behind it will take the user to a credential-harvesting phishing site that impersonates LogMeIn’s real sign-in page.
The researchers point out that, due to the current environment of pandemic-driven remote work, a fake security update is likely to be an effective lure for users of collaborative tools like LogMeIn.
“Other collaboration platforms have been under scrutiny for their security as many have become dependent on them to continue their work given the current pandemic,” they write. “Because of this, frequent updates have become common as many platforms are attempting to remedy the situation. A recipient may be more inclined to update because they have a strong desire to secure their communications.”
Additionally, the researchers note that LogMeIn uses single sign-on (SSO) with its subsidiary LastPass, so the attackers may be trying to gain access to victims’ password managers, which could potentially grant them access to all of the victims’ credentials.
The researchers say they’ve seen a spike in phishing campaigns targeting collaborative platforms, and they attribute this trend to the shift to remote working conditions.
“We’ve seen an incredible uptick in collaboration software impersonations in the past month,” they write. “Most of these platforms are associated with other logins (like G Suite or Office 365 logins) and can be leveraged by attackers to gain access to or assault other accounts.”
Once an attacker has compromised one account within your organization, they can use that account to launch more targeted attacks against other employees. New-school security awareness training can create a culture of security within your organization, enabling your employees to identify phishing emails and instilling in them the importance of multi-factor authentication.
Abnormal Security has the story: https://abnormalsecurity.com/blog/abnormal-attack-stories-logmein-phishing/
Here's how it works:
