Threat actors are abusing Microsoft’s infrastructure to launch phishing attacks that can bypass security measures, according to researchers at Guardz.
The attackers compromise multiple Microsoft 365 tenants in order to generate legitimate transaction notifications that contain phishing messages.
“This attack exploits legitimate Microsoft services to create a trusted delivery mechanism for phishing content, making it difficult for both technical controls and human recipients to detect,” the researchers write.
“Unlike traditional phishing, which relies on lookalike domains or email spoofing, this method operates entirely within Microsoft’s ecosystem, bypassing security measures and user skepticism by leveraging native M365 infrastructure to deliver phishing lures that appear authentic and blend in seamlessly.”
The attackers use Microsoft 365’s built-in tenant display name feature to display the phishing message rather than placing it in the email body. In one case, for example, the attackers set the display name to the following: “(Microsoft Corporation) Your subscription has been successfully purchased for 689.89 USD using your checking account. If you did not authorize this transaction, please call 1(888) 651-4716 to request a refund.”
The researchers explain, “The attacker weaponizes the tenant’s organization name field to inject a phishing lure directly into the email. Instead of embedding malicious links, the message instructs victims to call a fraudulent support number, leading to a social engineering attack designed to lure the victim to install a stealer (malware) / steal financial information or credentials.”
The attackers are using this technique to carry out business email compromise (BEC) attacks. Guardz notes that since the messages tell the victim to call a phone number, the scam is less likely to be stopped by technical security measures.
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Guardz has the story.
Here's how it works:
