In what appears to be a phishing attack that includes a mix of emails and phone calls, Microsoft reminds us to be wary of only opening emails and attachments from known contacts.
Perhaps taking a page from the recent Amazon-themed credit card scam that leverages vishing instead of malicious links, Microsoft has put out a warning of a new attack that starts out as a fake payment notification. The “call center” staffers inform the victim caller of a need to fill out a form, quicky sending over a password-protected zip file that actually contains a malicious Word doc used to infect endpoints with ransomware.
The scam uses the following path, according to Microsoft:
Source: Microsoft Security Intelligence via Twitter
What makes this scam so interesting is the fact that users must be fooled three times:
- That the initial fake invoice is real and that they must call to cancel it
- That the call center support team is real and that an emailed Word doc (instead of a web form) is the means to cancel the payment
- That a Word doc would be emailed inside of a zip file that sits behind a password
None of this sounds very customer-friendly – which should set off some red flags for users with any level of vigilance in place.
It’s stories of users falling for attacks like these that make it critical for organizations to put Security Awareness Training in place to educate users on various types of email attacks, methods used to install software or steal credentials, and the need for the user themselves to play a part in the organization’s security.
I’d file this attack in the “C’mon… really? People fall for that?” category, which only helps make my point about every organization needing proper security awareness training.
Here's how it works:
