Attackers use simple cause for concern as the basis of a scam intent on tricking victims into offering up their Office 365 credentials.
A very official-looking email is making the rounds, taking advantage of the approximately 50% of companies today using Office 365. And it’s not surprising, as Microsoft is the most impersonated brand in phishing attacks today. According to a recent article at Bleeping Computer, this attack takes advantage of the victim’s worry about files being deleted. Creating a sense of urgency is a common tactic in phishing emails, as it is sufficient to get recipients to move into action.
Upon clicking the email, users are presented with a similarly realistic-looking Office 365 logon page:
Note the URL in the image above - while looking like the real thing, it's most-definitely not from Microsoft, but does use a context-signaling domain of windows.net. Scams like this seek to capture user credentials to either be sold on the Dark Web or to further a more complex fraud or data theft attack on an organization.
Users should be encouraged to scrutinize emails and logon pages for URLs used to ensure the page being used for authentication to Office 365 is, in fact, on the office.com domain. Organizations putting users through continual Security Awareness Training already have this attack method covered, effectively preparing users to spot fake emails well before they can be fooled by look-alike logon pages.
Free Phishing Security Test
Find out what percentage of your employees are Phish-prone™
Would your users fall for convincing phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here's how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:
