New Phishing Platform Targets Microsoft 365 Accounts at Financial Firms

Phishing Platform TargetsAnalysis of the latest phishing-as-a-service (PhaaS) platform ONNX Store highlights just how successful these platforms can be.

Security analysts at threat intelligence vendor Eclectic IQ have been tracking ONNX Store, noting it’s a rebranded evolution of the Caffeine PhaaS platform. According to analysis, ONNX has been used to target financial institutions, “including banks, private funding firms and credit union service providers across the EMEA and AMER regions.”

This platform uses a combination of socially-engineered phishing emails, QR codes contained within PDF attachments, impersonated Microsoft 365 authentication pages hosted on bulletproof hosting services, proxied MFA, and encrypted JavaScript code to avoid detection.

Eclectic IQ mapped out all the services, websites, bots and more used as by this elaborate platform:

ONNX PaaS- image001

Source: Electric IQ

It's a rather elaborate setup.

This expository look at ONNX Store should have organizations worried. Something this sophisticated that takes into account just about every way a user or security solution could detect it’s a phishing attack is troublesome.

The one element of the attack that even ONNX can’t mimic perfectly is the phish itself.  It requires the recipient to believe they need to open a PDF attachment and then use their mobile phone to scan the QR code to read the document.

Users that undergo continual security awareness training will realize when first receiving such an email that it’s unexpected and – therefore – suspect to being with. 

KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Topics: Phishing

Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews