New Office 365 Credential Scam Uses a Received Fax to Trick Victims

Office 365 Credential Scam Uses FaxA clever mix of brand impersonation, a supposedly received message, a thumbnail preview, and new spoofed Office 365 logon pages are all that’s needed to trick victims into giving up credentials.

A new targeted phishing attack seen by security researchers at Abnormal Security appears to have already impacted hundreds of organizations successfully using a personalized notification of a received fax.

Posing as notifications from legitimate electronic fax services such as eFax, the phishing emails often use legitimate compromised email addresses, with the contents providing enough detail to pique the curiosity of the recipient, seeking to lure them into clicking on a “View Document” link:

eFax Spoofed Email

Source: Abnormal Security

According to Abnormal Security, “the embedded URLs redirect to fake, never-seen-before Microsoft O365 spear phishing pages hosted on digital publishing sites like Joom, Weebly and Quip, of which hundreds have been detected.”

Because of the mix of compromised accounts and never before seen spoofed logon pages, these attacks are finding their way into Inboxes, putting organizations at risk.

Organizations need to make users mindful through Security Awareness Training that educates users on these kinds of attacks, how to maintain a vigilant sense of scrutiny, and how to ignore such emails resulting in reducing your organization’s threat surface.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Free Phishing Security Resource Kit

Get the latest about social engineering

Subscribe to CyberheistNews