A phishing campaign is impersonating HR to target employees who are making annual insurance changes during the open enrollment period, according to researchers at Abnormal Security.
The attackers are using legitimate notifications from Dropbox to send phishing messages, asking recipients to view a document on Dropbox regarding annual salary increases and open enrollment elections.
If a user clicks the link, they’ll be taken to a Dropbox document containing another link that will redirect them to a spoofed Microsoft login page designed to steal their credentials.
“Upon logging in, they can view the document, which features a combination of impersonated Microsoft and Docusign branding to give the semblance of legitimacy,” the researchers write.
“It also includes a note stating the file ‘contains sensitive information that has been encrypted’ in an attempt to further reinforce the pretext that the document was really sent from the HR department. When the target clicks on either ‘REVIEW DOCUMENT’ or ‘DOWNLOAD DOCUMENT,’ they are redirected to a spoofed Microsoft OneDrive portal and prompted to provide their Microsoft login credentials.”
Since both the email and the link come from Dropbox, the messages are unlikely to be flagged as malicious.
“As previously mentioned, the initial email is indistinguishable from an authentic Dropbox notification because everything about it is legitimate—except the intent behind it,” Abnormal Security explains. “Further, unlike the vast majority of phishing attacks, the malicious link isn’t contained within the email.
It exists within a separate document hosted on a genuine file-hosting service, and it’s only after the target leaves the email environment and engages with the shared file that they’re exposed to the phishing link.”
New-school security awareness training can give your organization an essential layer of defense against social engineering attacks. KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Abnormal Security has the story.
How BreachSim works:
