Microsoft Teams Impersonation Attacks Flood Inboxes

guest · May 2, 2020

Microsoft Teams Impersonation Attacks Flood Inboxes
Two separate attacks have targeted as many as 50,000 different Teams users, with the goal of phishing Office 365 logins
May 1, 2020
https://threatpost.com/microsoft-teams-impersonation-attacks/155404/

A convincing cyberattack that impersonates notifications from Microsoft Teams in order to steal the Office 365 credentials of employees is making the rounds, according to researchers. Two separate attacks have targeted as many as 50,000 different Teams users, according to findings from Abnormal Security.

In one, employees receive an email that contains a link to a document on a domain used by an established email marketing provider to host static material used for campaigns. If recipients click the link, they’ll be presented with a button asking them to log in to Microsoft Teams – if that button is clicked, they’re taken to a malicious page which impersonates the Microsoft Office login page in order to steal their credentials.

“Attackers utilize numerous URL redirects in order to conceal the real URL used that hosts the attacks,” the firm’s researchers said in an analysis released on Friday.
Click to expand...

In the second attack, the email link points to a YouTube page, from which users are redirected twice to finally land on another Microsoft login phishing site.

“These attackers crafted convincing emails that impersonate automated notification emails from Microsoft Teams,” according to the analysis.
Click to expand...

Abnormal Security: Abnormal Attack Stories: Microsoft Teams Impersonation

guest · Oct 22, 2020

Microsoft Teams Phishing Attack Targets Office 365 Users
October 22, 2020
https://threatpost.com/microsoft-teams-phishing-office-365/160458/

Researchers are warning of a phishing campaign that pretends to be an automated message from Microsoft Teams. In reality, the attack aims to steal Office 365 recipients’ login credentials.

Teams is Microsoft’s popular collaboration tool, which has particularly risen in popularity among remote workforces during the pandemic – making it an attractive brand for attackers to impersonate. This particular campaign was sent to between 15,000 to 50,000 Office 365 users, according to researchers with Abnormal Security on Thursday.

“Because Microsoft Teams is an instant-messaging service, recipients of this notification might be more apt to click on it so that they can respond quickly to whatever message they think they may have missed based on the notification,” said researchers in a Thursday analysis.
Click to expand...

The initial phishing email displays the name “There’s new activity in Teams,” making it appear like an automated notification from Microsoft Teams.
To respond, the email urges the recipient to click on the “Reply in Teams” button – However, this leads to a phishing page.

Researchers said that the phishing landing page also looks convincingly like a Microsoft login page with the start of the URL containing “microsftteams.” If recipients are convinced to input their Microsoft credentials into the page, they are unwittingly handing them over to attackers, who can then use them for an array of malicious purposes – including account takeover.
Click to expand...

Abnormal Security: Microsoft Teams Impersonation

In this attack, an impersonated Microsoft Teams email is used to deliver a phishing campaign.
Click to expand...

Log in or Sign up

Microsoft Teams Impersonation Attacks Flood Inboxes

guest Guest

guest Guest

Log in or Sign up

Microsoft Teams Impersonation Attacks Flood Inboxes

guest Guest

guest Guest

Useful Searches