Email Sandboxes Are Detected and Rendered Useless in New Office 365 Phishing Attack

Email Phishing AttackA new threat tactic is being used to determine if sandbox environments are being used to gain more information about a potential phishing attack, allowing the bad guys to avoid detection.

I’ve written countless articles about attacks seeking to trick users out of their Office 365 credentials. In nearly every case, it involves redirecting the victim to a fake logon page. Security solutions today that scan web targets from outbound web requests (like those used in these Office 365 scams) typically help protect users by first seeing how the webpage interacts in a protected “sandbox” environment, before allowing the user to connect to the site.

But a new method of detection avoidance has been found by Microsoft where redirector URLs are used that first detect incoming connections to determine if it’s your sandbox doing the connecting, or your user. If the former, the redirection is pointed towards the legitimate Office 365 page. If the latter, your user may quickly become the next victim.

And this isn’t even the bad news.

Despite the fact that the design of the emails used to obfuscate their malicious intent results in some very poorly presented content (see below), the really bad news is your users are still falling for it!

www.bleepstatic.comimagesnewsu11092922020Phishing email samples(1)

Source: Microsoft

What seems obvious to you and me is anything but to your users; they need to be educated via Security Awareness Training about how phishing scams work, the tactics used, and – candidly – how an email that looks like the above needs to be assumed to be a complete sham until proven otherwise.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Topics: Phishing

Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews