New phishing campaign abuses a trio of enterprise cloud services

mood · Jul 21, 2020

New phishing campaign abuses a trio of enterprise cloud services
July 18, 2020
https://www.bleepingcomputer.com/ne...n-abuses-a-trio-of-enterprise-cloud-services/

A new phishing campaign uses a trio of enterprise cloud services, Microsoft Azure, Microsoft Dynamics, and IBM Cloud, as part of an attempt to steal your login credentials.

In this campaign, the domain “servicedesk.com” is used in the “From:” (envelope) address matches the domain listed in the last “Received:” header, making it more easily bypass spam filters.
And more importantly, lack of DMARC, DKIM and SPF validations on the “servicedesk.com” domain enable spammers to take advantage of this domain as demonstrated in these attacks.
Click to expand...

Microsoft and IBM domains add legitimacy
Using three well-known enterprise solutions like IBM Cloud hosting, Microsoft Azure, and Microsoft Dynamics to host the phishing landing pages adds legitimacy to the campaign.

This is especially true as domains hosted on Azure (windows.net) or IBM Cloud automatically get free SSL certificates that contain these companies' names, adding even more legitimacy.
Click to expand...

mood · Jul 21, 2020

Phishing campaign uses Google Cloud Services to steal Office 365 logins
July 21, 2020
https://www.bleepingcomputer.com/ne...le-cloud-services-to-steal-office-365-logins/

Fraudsters looking to collect login details are increasingly turning to public cloud services to host lure documents and phishing pages, making it more difficult for targets to detect the attack.
The trend has gained traction among cybercriminals, who rely on multiple cloud services to host phishing landing pages and the lure documents redirecting to them.
Sneaky tactics
Researchers at Check Point describe in a report today that the attackers relied on Google Drive to host a malicious PDF document and Google’s “storage.googleapis[.]com” to host the phishing page.

Google’s cloud services are not the only ones abused this way. BleepingComputer analyzed a recent phishing campaign that used Microsoft Azure, Microsoft Dynamics, and IBM Cloud.
Click to expand...

Once the potential victim takes the bait and follows the Access Document link, the phishing page hosted in Google Cloud Platform loads asking to log in using Office 365 credentials or an organization’s ID.
Check Point highlights that victims are unlikely to spot the scam since the pages load from legitimate sources and at the end of the process a genuine PDF document from a reputable company is delivered.

Using three well-known enterprise solutions like IBM Cloud hosting, Microsoft Azure, and Microsoft Dynamics to host the phishing landing pages adds legitimacy to the campaign.
Click to expand...

Check Point Research: How scammers are hiding their phishing trips in public clouds

Log in or Sign up

New phishing campaign abuses a trio of enterprise cloud services

mood Updates Team

mood Updates Team

Log in or Sign up

New phishing campaign abuses a trio of enterprise cloud services

mood Updates Team

mood Updates Team

Useful Searches