A new threat tactic is being used to determine if sandbox environments are being used to gain more information about a potential phishing attack, allowing the bad guys to avoid detection.
I’ve written countless articles about attacks seeking to trick users out of their Office 365 credentials. In nearly every case, it involves redirecting the victim to a fake logon page. Security solutions today that scan web targets from outbound web requests (like those used in these Office 365 scams) typically help protect users by first seeing how the webpage interacts in a protected “sandbox” environment, before allowing the user to connect to the site.
But a new method of detection avoidance has been found by Microsoft where redirector URLs are used that first detect incoming connections to determine if it’s your sandbox doing the connecting, or your user. If the former, the redirection is pointed towards the legitimate Office 365 page. If the latter, your user may quickly become the next victim.
And this isn’t even the bad news.
Despite the fact that the design of the emails used to obfuscate their malicious intent results in some very poorly presented content (see below), the really bad news is your users are still falling for it!
.jpg?width=609&name=www.bleepstatic.comimagesnewsu11092922020Phishing%20email%20samples(1).jpg)
Source: Microsoft
What seems obvious to you and me is anything but to your users; they need to be educated via Security Awareness Training about how phishing scams work, the tactics used, and – candidly – how an email that looks like the above needs to be assumed to be a complete sham until proven otherwise.
Here's how it works:
