Using Legitimate Services to Bypass Phishing Protections



Legitimate Services Bypass Phishing ProtectionsResearchers at Abnormal Security have identified two techniques that attackers are using to bypass email security filters. The first tactic takes advantage of the fact that Microsoft Office 365 sends automated read receipts for emails that are deleted without being read.

“The scammer prepares a BEC attack (in this case, an extortion email), and manipulates the email headers (‘Disposition-Notification-To’) so the target would receive a read receipt notification from M365, instead of the attacker,” the researchers explain. “The extortion email is sent, gets by traditional security solutions and lands in the employee inbox, where it is auto-remediated by Abnormal. However, even though the original extortion email was auto-remediated, the manipulated email header triggered a read receipt notification back to the target that includes the text of the extortion.”

In the example shared by Abnormal, the subject of the unread message was “I have full control of your device,” which could catch the attention of the user even if the email didn’t end up in their inbox.

The second technique involves redirecting an automated out-of-office reply to another employee within the organization.

“Similar to the read receipts scam, the scammer prepares a BEC attack (another extortion email), and manipulates the email headers (‘Reply-To’),” the researchers write. “The difference here is, if the target has an Out of Office Reply turned ON, the notification can be directed to a second target within the organization, not the attacker. As with the Read Receipts attack, the extortion email gets by traditional security solutions and lands in the employee inbox, where it is auto-remediated by Abnormal. Even though the original extortion email was auto-remediated, the manipulated email header triggered an Out of Office reply to a second target that includes the text of the extortion.”

Cybercriminals are always finding new ways to get around technical security measures. New-school security awareness training can give your organization an essential layer of defense by teaching your employees to identify phishing emails that will inevitably slip through the cracks.

Abnormal Security has the story.


Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/phishing-security-test-offer

Topics: Phishing

Subscribe To Our Blog


Cybersecurity Awareness Month Resource Kit




Get the latest about social engineering

Subscribe to CyberheistNews