“File Deletion” Alert Becomes the Latest Scam to Compromise Office 365 Credentials

Written by KnowBe4’s Stu Sjouwerman

Office 365 Users on Attack

Attackers use a simple cause for concern as the basis of a scam intent on tricking victims into offering up their Office 365 credentials.

A very official-looking email is making the rounds, taking advantage of the approximately 50% of companies today using Office 365. And it’s not surprising, as Microsoft is the most impersonated brand in phishing attacks today. According to a recent article at Bleeping Computer, this attack takes advantage of the victim’s worry about files being deleted. Creating a sense of urgency is a common tactic in phishing emails, as it is sufficient to get recipients to move into action.

Upon clicking the email, users are presented with a similarly realistic-looking Office 365 login page:

landing-page

 

Note the URL in the image above – while looking like the real thing, it’s most definitely not from Microsoft, but does use a context-signaling domain of windows.net. Scams like this seek to capture user credentials to either be sold on the Dark Web or to further a more complex fraud or data theft attack on an organization.

Train Your Employees

Users should be encouraged to scrutinize emails and login pages for URLs used to ensure the page being used for authentication to Office 365 is, in fact, on the office.com domain. Organizations putting users through continual Security Awareness Training already have this attack method covered, effectively preparing users to spot fake emails well before they can be fooled by look-alike login pages.

Article Link