Researchers at Abnormal Security have identified two techniques that attackers are using to bypass email security filters. The first tactic takes advantage of the fact that Microsoft Office 365 sends automated read receipts for emails that are deleted without being read.
“The scammer prepares a BEC attack (in this case, an extortion email), and manipulates the email headers (‘Disposition-Notification-To’) so the target would receive a read receipt notification from M365, instead of the attacker,” the researchers explain. “The extortion email is sent, gets by traditional security solutions and lands in the employee inbox, where it is auto-remediated by Abnormal. However, even though the original extortion email was auto-remediated, the manipulated email header triggered a read receipt notification back to the target that includes the text of the extortion.”
In the example shared by Abnormal, the subject of the unread message was “I have full control of your device,” which could catch the attention of the user even if the email didn’t end up in their inbox.
The second technique involves redirecting an automated out-of-office reply to another employee within the organization.
“Similar to the read receipts scam, the scammer prepares a BEC attack (another extortion email), and manipulates the email headers (‘Reply-To’),” the researchers write. “The difference here is, if the target has an Out of Office Reply turned ON, the notification can be directed to a second target within the organization, not the attacker. As with the Read Receipts attack, the extortion email gets by traditional security solutions and lands in the employee inbox, where it is auto-remediated by Abnormal. Even though the original extortion email was auto-remediated, the manipulated email header triggered an Out of Office reply to a second target that includes the text of the extortion.”
Cybercriminals are always finding new ways to get around technical security measures. New-school security awareness training can give your organization an essential layer of defense by teaching your employees to identify phishing emails that will inevitably slip through the cracks.
Abnormal Security has the story.
Here's how it works:
