Researchers at Zix have observed phishing emails sent from legitimate but compromised university email accounts, impersonating the university’s IT department. The emails notified users that their Office 365 password had expired, and directed them to click a link to keep their same password. The link led to a spoofed Office 365 login page designed to harvest their credentials.
“These email messages dissected above stood out to the Zix | AppRiver team because they managed to successfully bypass sender verification checks such as Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC),” the researchers write. “They also did not just simply spoof .EDU in the friendly-from/display address.”
This incident highlights why users need to consider the circumstances and content of emails, rather than assuming the messages are legitimate because they come from a trusted account. In this case, the format of the email’s text was strange-looking, with underscores between each letter, which could have tipped many users. Additionally, the link in the email led to a URL that didn’t remotely resemble an Office 365 site.
Many phishing emails are better-crafted than this one, however. The Zix researchers spotted a second email from a compromised university account that instructed recipients to click a link to upgrade their Outlook apps to the latest version. This email contained slight grammatical errors, but was much more convincing than the first email. The link led to a phishing portal hosted on Google Docs, rather than to a suspicious-looking domain.
If a recipient is unsure if an email is legitimate, they can reset their password by going directly to their account in a web browser, rather than clicking on a link in an email. They should also call the university’s IT department to alert them of a potential phishing campaign using compromised university accounts.
New-school security awareness training can help your employees identify phishing emails and respond appropriately.
Zix has the story.
Here's how it works:
