Microsoft Sway abused in PerSwaysion spear-phishing operation

guest · Apr 30, 2020

Microsoft Sway abused in PerSwaysion spear-phishing operation
April 30, 2020
https://www.bleepingcomputer.com/ne...used-in-perswaysion-spear-phishing-operation/

Multiple threat actors running phishing attacks on corporate targets have been counting on Microsoft Sway service to trick victims into giving their Office 365 login credentials.

Named PerSwaysion by security researchers, the campaign relies on a phishing kit offers in a malware-as-a-service (MaaS) operation and is a well-planned endeavor.
Apart from access to corporate email accounts, scammers also get sensitive business data, which opens a wide range of money-making possibilities.
Cherry-picked targets
PerSwaysion has been running since at least August 2019 and emails of at least 27 adversaries have been found in several variants of the phishing kit.
Click to expand...

Sway-ing the victim
The role of the PDF is to impersonate a notification from Office 365, something that the adversary managed to do quite well, adding the full name of the sender, their email address, and company.

When the target clicks the “Read Now” link, they are taken to a file hosted on Microsoft Sway that seems like a genuine Office 365 file-sharing page.
Clicking the “Read Now” link on this page takes the target to the phishing site that is disguised as a Microsoft Single Sign-on page.
Click to expand...

Tracking the PerSwaysion actors
Being a MaaS, PerSwaysion is currently used by multiple groups. Using its resources, Group-IB was able to uncover that the "phishing kit development team has a strong link to Vietnamese speaking community."
Click to expand...

Group-IB: Group-IB uncovers PerSwaysion — sophisticated phishing campaign targeting executives worldwide

PerSwaysion is a highly-targeted phishing campaign. One of the defining signatures of PerSwaysion is that it spreads like wildfire jumping from one victim to another while no malware is present on a user device during the attack.

New round of phishing attempts leveraging current victim’s account usually takes less than 24 hours. The campaign resulted in a compromise of 156 high-ranking officers in global and regional financial hubs such as the US, Canada, Germany, the UK, Netherlands, Hong Kong, Singapore, and other locations.
Click to expand...

guest · Nov 18, 2021

'PerSwaysion' Phishing Campaign Still Ongoing, and Pervasive
November 18, 2021
https://www.darkreading.com/vulnera...nues-to-be-an-active-threat-for-organizations

A phishing kit that has been used in thousands of attacks worldwide has been active for significantly longer than previously thought — and it continues to pose a potent threat to organizations across multiple sectors, new analysis shows.

The kit, named PerSwaysion, is designed to give cybercriminals a way to launch a phishing campaign relatively easily and with little up-front effort. The most notable aspect about the threat is its use of Microsoft file-sharing services, such as Sway, SharePoint, and OneNote, to lure users to credential-stealing sites.
Click to expand...

An analysis of data from URLscan showed that over the last 18 months alone, some 7,403 people from across 14 industry sectors landed on 444 unique PerSwaysion phishing portals at some point.
Pearson estimates the number of organizations impacted by the campaign since May 2020 to be, at least, in the high hundreds.

"Realistically, this has gone on for so long it is likely that just about [every sector] is impacted," Pearson says. "This is a phishing kit that has customers all over the world, and [attackers] are targeting whoever they want."
Security vendor Group-IB gave the campaign its name last year after observing how extensively it abused the Sway service as part of the attack chain. In an April 2020 report, [...]
Click to expand...

Drag-and-Drop Op
Pearson says his analysis of PerSwaysion shows the kit essentially makes deploying a phishing portal a drag-and-drop operation for attackers. The kit contains templates for spoofing account login pages belonging to eight trusted brands, including Microsoft, Google, Facebook, Twitter, and — as an indication of just how long the kit has been around — some older brands like Hotmail and AOL.
Fresh Insight
Pearson says SeclarityIO was also able to uncover fresh insight into the attack vectors that different threat actors used to initially deliver the PerSwaysion kit to potential victims thanks to its network interpreter technology.
Click to expand...

Pearson says SeclarityIO has been unable to determine how the PerSwaysion kit is marketed. They have also been unable to dig up any more information on who might have developed the kit beyond what Group-IB already revealed last year: that the operators likely are Vietnamese-speaking.
Click to expand...

Pearson: The Art of PerSwaysion - Investigation of a Long-Lived Phishing Kit

Phishing kits are some of the most powerful enablers of digital crime. By having a cookie-cutter, ready-made format that can be purchased by anyone, the barrier to entry in creating convincing fake login portals is nearly eliminated. There have been several reports in recent months (TodayZoo1, most recently) that point out attacks leveraging phishing kits.

This report investigates a kit that has stayed active for more than four years. In just the last 18 months, thousands of users across more than a dozen public and private sectors are known to have been affected, suggesting that this kit has had a tremendous impact on organizations far and wide.
Click to expand...

Log in or Sign up

Microsoft Sway abused in PerSwaysion spear-phishing operation

guest Guest

guest Guest

Log in or Sign up

Microsoft Sway abused in PerSwaysion spear-phishing operation

guest Guest

guest Guest

Useful Searches