Credential phishing attack uses fake DHL emails to breach Microsoft 365

A brand new report from researchers from Armorblox Inc. particulars a brand new spin on a credential-phishing assault that makes use of an old favorite — faux transport correspondence from DHL — to breach Microsoft 365 and Alternate On-line Safety.

The phishing marketing campaign focused greater than 10,000 inboxes at a non-public schooling establishment and used social engineering and model impersonation to duplicate current enterprise workflows, with a malicious attachment thrown in for good measure.

The emails concentrating on the establishment had been titled “DHL Transport Doc/Bill Receipt” to encourage victims to open the e-mail in a well timed trend. At first look, the e-mail seems official, full with a response electronic mail that features DHL. The physique of the e-mail consists of DHL branding and informs recipients a few parcel despatched by a buyer that must be rerouted to the proper supply handle.

The physique of the e-mail has one name to motion: to view an connected doc to verify the vacation spot handle of the parcel cargo. The attachment, named “Transport Doc Bill Receipt,” additional instills belief within the unsuspecting sufferer.

Not surprisingly, the attachment will not be what it appears. Upon opening the doc, viewers are supplied a blurred-out preview of the attachment’s content material – a Microsoft Excel file. To entry the doc, viewers are then prompted to offer their Microsoft login credentials, being tricked into believing that they need to achieve this to view the file. Then their usernames and passwords are despatched on to the attacker.

“The e-mail assault used language as the primary assault vector so as to bypass each Microsoft Workplace 365 and EOP electronic mail safety controls,” the researchers clarify. “These native electronic mail safety layers are capable of block mass spam and phishing campaigns and identified malware and unhealthy URLs. Nevertheless, this focused electronic mail assault bypassed Microsoft electronic mail safety as a result of it didn’t embrace any unhealthy URLs or hyperlinks and included an HTML file that included a malicious phishing type.”

Through the use of a legitimate area, the emails bypassed all of Microsoft’s electronic mail authentication checks.

The researchers advise that native electronic mail safety, corresponding to that supplied by Microsoft, ought to be augmented for higher safety in opposition to electronic mail assaults. Coaching workers to search for faux messages corresponding to these can also be talked about as one other methodology to guard in opposition to phishing campaigns. As well as, multifactor authentication and password administration finest practices ought to be deployed to scale back the danger of attackers having access to accounts.

Picture: Raimond Spekking/Wikimedia Commons