Researchers at Avanan warn that a phishing campaign is using Microsoft’s Dynamic 365 Customer Voice feature to send malicious links. Customer Voice is designed to collect feedback from customers, but attackers are using it to send phony links claiming that the recipient has received a voicemail.
“This email comes from the survey feature in Dynamics 365,” the researchers write. “Interestingly, you’ll notice the sending address has ‘Forms Pro’ in it, which is the old name of the survey feature. The email shows that a new voicemail has been received. To the end user, this looks like a voicemail from a customer, which would be important to listen to. Clicking on it is the natural step.”
The link to the fake voicemail comes from a Microsoft domain, so email security products tend to view it as safe.
“This is a legitimate Customer Voice link from Microsoft,” Avanan says. “Because the link is legit, scanners will think that this email is legitimate. However, when clicking upon the ‘Play Voicemail’ button, hackers have more tricks up their sleeves. The intent of the email is not in the voicemail itself; rather, it is to click on the ‘Play Voicemail’ button, which redirects to a phishing link.”
Avanan notes that attackers are increasingly abusing legitimate platforms to bypass email security filters.
“We’ve seen this a lot recently, whether it’s Facebook, PayPal, QuickBooks or more. It is incredibly difficult for security services to suss out what is real and what is nested behind the legitimate link,” the researchers write. “Plus, many services see a known good link and, by default, don’t scan it. Why scan something good? That’s what hackers are hoping for.
This is a particularly tricky attack because the phishing link doesn’t appear until the final step. Users are first directed to a legitimate page–so hovering over the URL in the email body won’t provide protection. In this case, it would be important to remind users to look at all URLs, even when they are not in an email body. These attacks are incredibly difficult to stop for scanners and even harder for users to identify.”
New-school security awareness training can give your organization an essential layer of defense against social engineering attacks.
Avanan has the story.
