Rewterz Threat Alert – Phishing Emails Are Using SharePoint to Attack Banks

Severity

Medium

Analysis Summary

A phishing campaign attempting to harvest credentials, specifically from the banking industry. This campaign begins with an email attempting to lure victims into clicking a link by asking them to review a proposal document. The link in the body of the email leads to a legitimate, but compromised, SharePoint site. Using a SharePoint link and a well known domain, attackers are easily able to bypass email security devices. Visiting the link leads to a OneNote document blurred in order to convince users to click another link to download the legible version of the file. This link redirects them to the final step of the attack, a OneDrive phishing page. Victims are presented with multiple options for signing on in order to increase the chances of victims falling for the phishing attempt. The researchers downloaded the content of this phishing site and identified that the login page used a PHP file to exfiltrate the credentials back to the attacker via a compromised email account. They also found other files on the site including a read me file that indicates the attacker leveraged a phishing exploit kit that can be purchased from the developer as part of a set of hacking tools.

Impact

Credential theft

Indicators of Compromise

URLs

• https[:]//alblatool[.]com/xxx/one/
• https[:]//botleighgrange-my[.]sharepoint[.]com/[:]o[:]/p/maintenance/EngTNCs22_REkaJY4gVf9lwBqkwYFtDSmJJ7L2H-AnoDQg?e=tgtauL
• https[:]//alblatool[.]com/xxx/one/office365/index[.]php

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the link/attachments sent by unknown senders.