Large-Scale Phishing Attacks Targeting Microsoft Enterprise Email Services

Safety researchers from ThreatLabz have uncovered a brand new pressure of a large-scale phishing marketing campaign utilizing adversary-in-the-middle (AiTM) strategies together with a number of evasion ways.

In accordance with an advisory printed by the corporate on Tuesday, comparable AiTM phishing strategies had been utilized in a separate phishing marketing campaign described by Microsoft final month.

Now, ThreatLabz revealed that utilizing intelligence gathered from the Zscaler cloud, it noticed a rise in the usage of superior phishing kits in a large-scale marketing campaign in June.

The safety agency defined the brand new marketing campaign stood out from “generally seen” phishing assaults for plenty of causes.

Firstly, similar to the marketing campaign noticed by Microsoft, it used AiTM to bypass multi-factor authentication (MFA). Secondly, it used a number of evasion strategies throughout numerous phases of the assault designed to bypass typical e mail safety and community safety options.

The truth is, primarily based on the information analyzed by ThreatLabz, the corporate believes the marketing campaign is particularly designed to succeed in finish customers in enterprises that use Microsoft’s e mail companies. 

“Enterprise e mail compromise (BEC) continues to be an ever-present risk to organizations and this marketing campaign additional highlights the necessity to shield towards such assaults,” the advisory learn.

In accordance with ThreatLabz, all these phishing assaults start with an e mail despatched to the sufferer with a malicious hyperlink, and the marketing campaign is lively on the time of writing, with new phishing domains being registered nearly daily by the risk actors.

“Primarily based on our cloud information telemetry, the vast majority of the focused organizations had been within the fintech, lending, finance, insurance coverage, accounting, vitality and federal credit score union industries,” ThreatLabz mentioned.

Moreover, the agency mentioned many of the focused organizations had been positioned in the US, the UK, New Zealand and Australia.

To guard towards these assaults, ThreatLabz mentioned multi-factor authentication (MFA) must be used, however not be thought-about a silver bullet.

“With the usage of superior phishing kits (AiTM) and intelligent evasion strategies, risk actors can bypass each conventional in addition to superior safety options.”

As an additional precaution, ThreatLabz defined customers shouldn’t open attachments or click on on hyperlinks in emails despatched from untrusted or unknown sources. 

“As a greatest observe, typically, customers ought to confirm the URL within the handle bar of the browser earlier than coming into any credentials.”