Heimdal Security has come across a phishing campaign that uses compromised accounts to target Microsoft users. The attackers use email and social media accounts they’ve already breached to send malicious links to the hacked accounts’ contacts, so the targets receive the phishing messages from someone they trust. For example, one of Heimdal’s employees received a message from one of their LinkedIn contacts.
The messages contain business-related attachments that redirect users to a spoofed Microsoft Office 365 login portal, which has been set up to steal credentials. The page is identical to Microsoft’s real login page, but Heimdal notes that the URL is not even close to Microsoft’s, which should tip off observant users. The first domain was iradistribution[.]sofiatsola[.]com, and the second is markaldriedgehomes[.]com.
Heimdal notes that most cybersecurity solutions still don’t flag these sites as malicious. Both of the phishing domains Heimdal identified were modified five months ago, indicating that this campaign has probably been running for a while. The company expects to see more of these domains pop up in the coming weeks.
Heimdal recommends a combination of technical and human defenses to fight these attacks. DNS traffic filtering technology can help block malicious sites, and new-school security awareness training can teach your employees how to identify and thwart the attacks that get through.
Heimdal Security has the story: https://heimdalsecurity.com/blog/new-microsoft-phishing-campaign-targets-office365-users/
Here's how it works:
