Rewterz Threat Alert – Spear-Phishing Email Spoofs Microsoft Domain

Severity

Medium

Analysis Summary

A spear phishing campaign is observed targeting victims for harvesting credentials, using domain spoofing. The campaign is spoofing the official Microsoft.com domain name and targeting users of the company’s Office 365 suite. So far, the phishing email has been traced in few thousand mailboxes, while putting nearly 200 million users of Office 365 at risk. The messages originate with a spoofed domain that is an exact replica of the Microsoft.com domain, a technique called exact domain spoofing. The spear-phishing emails, so far, have targeted Office 365 users in the financial services, healthcare, insurance, manufacturing, utilities and telecom industries. In this campaign, the fraudsters are likely attempting to harvest users’ credentials. 

The link will redirect users to a security portal in which they can review and take action on ‘quarantined messages’ captured by the Exchange Online Protection (EOP) filtering stack. If a user clicks the link, they are directed to input their legitimate Office 365 login credentials on a fake login page. It is important to note that these phishing emails are bypassing secure email gateways installed by the targeted companies.

Impact

• Credential Theft
• Email Gateway Security Bypass

Remediation

• Do not respond to emails containing links, unless the sender is personally known and verifies having sent the email.