A new phishing campaign is attempting to frighten people into handing over their credentials by claiming Microsoft was hacked by Iran, BleepingComputer reports. The campaign is capitalizing on recent warnings from the US Department of Homeland Security and others about the possibility of Iranian state-sponsored cyberattacks in the wake of Qasem Soleimani’s death last week.
The phishing emails in this campaign contain the subject line “Email users hit by Iran cyber attack,” and they purport to come from “Microsoft MSA.” They claim Microsoft’s servers experienced a cyberattack from Iran, and the company had to lock down users’ data in order to protect it. Recipients of the emails are instructed to click a link that says “Restore Data” in order to regain access. Clicking this link will take them to a fairly convincing imitation of Microsoft’s login page, which is designed to steal their credentials.
Many modern phishing campaigns have polished spelling and grammar, making them very hard to spot. This isn’t one of those cases, however.
“Microsoft servers have been hit today with an Cyber Attack from Iran Government,” the emails say. “For your seifty and security we had to take extra measures to protect your account and your personal data. Some emails and files might still be locked on our servers, in order to get full access to your emails and files you have to signin again. If you still have problems receiving emails please be patient, our support team is working on this issue and we will fix this as soon as possible.”
The campaign isn’t particularly sophisticated, but the emails did manage to make it past spam filters, so it’s possible some recipients could have fallen for it.
Iranian state-sponsored cyberattacks are a real concern as well, and they often begin with phishing attacks. Sophisticated threat actors, including Iranian APTs, generally use much more convincing phishing emails that are tailored to their specific targets. New-school security awareness training can enable your employees to recognize low-grade phishing attempts like this one as well as more sophisticated spear phishing attacks.
BleepingComputer has the story: https://www.bleepingcomputer.com/news/security/microsoft-phishing-scam-exploits-iran-cyberattack-scare/
Here's how it works:
