Hacker Group Compromises the Email Accounts of More Than 150 Company’s High-Ranking Executives

iStock-1090872318 (2)The latest string of attacks leverage traditional spear-phishing techniques mixed with the use of Microsoft’s newsletter service, Sway, to trick executives into giving up their Office 365 credentials.

The group, dubbed perSwaysion for their use of Microsoft Sway as part of the attack, have successfully executed a string of campaigns aimed at stealing the Office 365 credentials of executives in over 150 companies.

The simple attack uses a non-malicious PDF attachment that links to a Microsoft Sway page that then links to a spoofed Office 365 logon page that collects the executive’s credentials. The success of such an attack puts organizations at risk; we’ve seen plenty of email account takeovers resulting in massive financial losses that the perSwaysion attack could facilitate.

According to security vendor Group-IB who spotted this new attack group, email is dumped via API and the email account owner's high-level business connections are established and documented. The attackers then perform a sort of island hopping, creating new PDFs that will be sent from the initially-compromised account to other high-ranking execs outside the organization with who they do business.

This kind of success highlights the need for even executives to undergo continual Security Awareness Training to be able to identify potentially malicious emails, as well as be subject to phishing testing to provide security teams with a feedback loop as to whether executives pose a risk to the organization.

Will your users respond to phishing emails?

KnowBe4's new Phishing Reply Test (PRT) is a complimentary IT security tool that makes it easy for you to check to see if key users in your organization will reply to a highly targeted phishing attack without clicking on a link. PRT will give you quick insights into how many users will take the bait so you can take action to train your users and better protect your organization from these fraudulent attacks!

PRT-imageHere's how it works:

  • Immediately start your test with your choice of three phishing email reply scenarios
  • Spoof a Sender’s name and email address your users know and trust
  • Phishes for user replies and returns the results to you within minutes
  • Get a PDF emailed to you within 24 hours with the percentage of users that replied

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:


Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews