Hacked SharePoint Sites Used to Bypass Secure Email Gateways

mood · Sep 3, 2019

Hacked SharePoint Sites Used to Bypass Secure Email Gateways
September 3, 2019
https://www.bleepingcomputer.com/ne...t-sites-used-to-bypass-secure-email-gateways/

Phishers behind a new campaign have switched to using compromised SharePoint sites and OneNote documents to redirect potential victims from the banking sector to their landing pages.

The emails sent as part of this new phishing campaign are delivered from compromised accounts and will ask the targets to review a legal assessors proposal via an URL embedded within the message as Cofense Cyber Incident Response researchers discovered.

"SharePoint is the initial delivery mechanism to deliver a secondary malicious URL, allowing the threat actor to circumvent just about any email perimeter technology," found Cofense.
After the victim inputs the credentials to login, they are automatically collected by the phishing kit sold by BlackShop Tools and used by this campaign's operators, with the information being subsequently delivered to what looks like yet another hacked email account.
Click to expand...

Cofense: Phishing Emails Are Using SharePoint to Slip Past Symantec’s Gateway and Attack Banks

Log in or Sign up

Hacked SharePoint Sites Used to Bypass Secure Email Gateways

mood Updates Team