Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Medium
A phishing campaign gained access to victim accounts when the victims granted the app access to their Office 365 account. Phishing emails were sent to potential victims and contained a link to what was advertised as a legitimate SharePoint or OneDrive file share. When the victim clicks on the link, they are sent to a legitimate Microsoft login page. After the victim logged in (or if they were previously logged in), they were presented with a “Permissions requested” page that the app in the URL required. Clicking the Accept button essentially granted the app (and therefore the attackers) full access to the Office 365 account. In addition, any single sign on (SSO) service that leveraged the victim’s Office 365 credentials could then be accessed by the attackers. PhishLabs indicated that just changing the account password does not close this window into the account – the victim must disassociate the app from the account.
Credential theft
URL
mtr.com%3A8081%2Foffice&scope=offline_access%20contacts.read%20user.read%20mail.read
%20notes.read.all%20mailboxsettings.readwrite%20Files.ReadWrite.All%20openid%20profile&state
=12345Ajtwmd&response_mode=%20form_post&nonce=YWxsYWh1IGFrYmFy