Attackers are abusing Microsoft Teams to send phishing messages, according to researchers at AT&T Cybersecurity.
“While most end users are well-acquainted with the dangers of traditional phishing attacks, such as those delivered via email or other media, a large proportion are likely unaware that Microsoft Teams chats could be a phishing vector,” the researchers write.
“Most Teams activity is intra-organizational, but Microsoft enables External Access by default, which allows members of one organization to add users outside the organization to their Teams chats. Perhaps predictably, this feature has provided malicious actors a new avenue by which to exploit untrained or unaware users.”
In the case observed by AT&T Cybersecurity, the attackers used a compromised domain to send the messages.
“An important detail to note here is the “.onmicrosoft[.]com” domain name,” the researchers write. “This domain, by all appearances, is authentic and most users would probably assume that it is legitimate. OSINT research on the domain also shows no reports for suspicious activity, leading the MDR SOC team to believe the username (and possibly the entire domain) was likely compromised by the attackers prior to being used to launch the phishing attack.”
In this case, the attackers sent users a malicious file with a double extension designed to trick users into thinking its a PDF file. This file, when opened, would install the DarkGate malware.
“The MDR SOC team continued to drill down on the phished users to determine the precise nature of the attack,” the researchers explain. “They subsequently discovered three users who had downloaded a suspicious double extension file. The file was titled ‘Navigating Future Changes October 2023.pdf.msi.’ Double extension files are commonly used by attackers to trick users into downloading malicious executables, as the second extension, .msi in this case, is usually hidden by the filesystem. The user believes they are downloading a PDF for business use, but instead receives a malicious installer.”
New-school security awareness training can give your employees a healthy sense of suspicion so they can recognize social engineering tactics. KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
AT&T Cybersecurity has the story.
Here's how it works:
