ZeroFox warns that phishing-as-a-service (PhaaS) offerings are increasingly including features to bypass multi-factor authentication.
“In 2023, ‘in-the-middle’ techniques are some of the most frequently-observed methods used to gain access to MFA-secured networks,” the researchers write.
“They enable threat actors to intercept or bypass MFA protocols by stealing communications without the victim’s knowledge. Threat actors create and exploit new sessions, or intercept existing ones, via session hijacking—including the stealing or selling of cookies and authentication tokens—session fixation, or session cloning.
Exploiting vulnerabilities at the application and network layers can grant threat actors access to an authenticated session, undermining MFA protocols. Attackers can seize control of session permissions and parameters, facilitating greater opportunity for exploitation and detection avoidance.”
A significant amount of phishing emails are used to deliver malware, particularly ransomware.
“Malicious email attachments will very likely remain one of the most prevalent means of malware distribution for the foreseeable future,” ZeroFox says.
“Reporting states that malicious attachments are leveraged in approximately 40 percent of phishing attacks and have been responsible for the delivery of 35 percent of ransomware so far in 2023—the highest of any delivery method.
Despite security controls being regularly updated to account for these file types—ensuring suspicious files are flagged to end users—it is very likely threat actors will continue to pivot to file types that circumvent security controls.”
The researchers note that attackers are using a variety of different file types and techniques to distribute malware.
“Threat actors increasingly leverage files such as Windows image files (ISO), archive files (RAR), Windows Shortcut files (LNK), OneNote files, restricted permission messages (RPMSG) files, and Windows Script files to deploy malicious payloads,” the researchers write.
“Threat actors have also been observed leveraging HTML smuggling to deliver prominent malware strains such as QBot and Emotet, whereby threat actors conceal a malicious script inside these files that is able to assemble and embed itself on the target network upon activation. This avoids malicious code being passed over the network.”
New-school security awareness training can give your organization an essential layer of defense by enabling your employees to thwart social engineering attacks.
ZeroFox has the story.
