Phishing Campaign Abuses Contact Forms

Phishing Campaign Contact FormsAttackers are abusing websites’ contact forms to send malicious emails to the websites’ owners, according to researchers at Microsoft. The emails contain bogus copyright claims with a link to a page. Clicking the link will result in the installation of the IcedID banking Trojan.

“In the samples we found, attackers used legal threats as a scare tactic while claiming that the recipients allegedly used their images or illustrations without their consent, and that legal action will be taken against them,” the researchers write. “There is also a heightened sense of urgency in the email wording, with phrases such as ‘you could be sued,’ and ‘it’s not legal.’ It’s a sly and devious approach since everything else about this email is authentic and legitimate.”

Microsoft notes that these phishing emails will be hard to spot unless users are looking out for them, since the emails are generated by the websites’ real contact forms and the phishing link leads to a domain.

“This campaign is not only successful because it takes advantage of legitimate contact form emails, but the message content also passes as something that recipients would expect to receive,” Microsoft says. “This creates a high risk of attackers successfully delivering email to inboxes, thereby allowing for ‘safe’ emails that would otherwise be filtered out into spam folders.”

The researchers conclude that this campaign shows how attackers are able to constantly adapt to bypass email security filters.

“As this research shows, adversaries remain motivated to find new ways to deliver malicious email to enterprises with the clear intent to evade detection” they write. “The scenarios we observed offer a serious glimpse into how sophisticated attackers’ techniques have grown, while maintaining the goal of delivering dangerous malware payloads such as IcedID. Their use of submission forms is notable because the emails don’t have the typical marks of malicious messages and are seemingly legitimate.”

New-school security awareness training can help your employees recognize social engineering tactics.

Microsoft has the full story

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Cybersecurity Awareness Month Free Resource Kit

Get the latest about social engineering

Subscribe to CyberheistNews