Phishing in Office 365's Pond

Angler_PhishingHeimdal Security has come across a phishing campaign that uses compromised accounts to target Microsoft users. The attackers use email and social media accounts they’ve already breached to send malicious links to the hacked accounts’ contacts, so the targets receive the phishing messages from someone they trust. For example, one of Heimdal’s employees received a message from one of their LinkedIn contacts.

The messages contain business-related attachments that redirect users to a spoofed Microsoft Office 365 login portal, which has been set up to steal credentials. The page is identical to Microsoft’s real login page, but Heimdal notes that the URL is not even close to Microsoft’s, which should tip off observant users. The first domain was iradistribution[.]sofiatsola[.]com, and the second is markaldriedgehomes[.]com.

Heimdal notes that most cybersecurity solutions still don’t flag these sites as malicious. Both of the phishing domains Heimdal identified were modified five months ago, indicating that this campaign has probably been running for a while. The company expects to see more of these domains pop up in the coming weeks.

Heimdal recommends a combination of technical and human defenses to fight these attacks. DNS traffic filtering technology can help block malicious sites, and new-school security awareness training can teach your employees how to identify and thwart the attacks that get through.

Heimdal Security has the story:

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Topics: Phishing

Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews