Office 365 Phishing Campaign Exploits Samsung, Adobe and Oxford Servers

guest · Jun 18, 2020

Check Point uncovers targeted Microsoft Office 365 phishing campaign
June 18, 2020
https://www.computerweekly.com/news...rgeted-Microsoft-Office-365-phishing-campaign

Check Point has discovered a sophisticated campaign of phishing attacks incorporating household names to gain a foothold on corporate networks and harvest login credentials stored on Microsoft Office 365 accounts.

“What first appeared to be a classic Office 365 phishing campaign, turned out to be a masterpiece strategy: using well-known and reputable brands to evade security products on the way to the victims,” said Check Point threat intelligence manager, Lotem Finkelsteen.
“To pull the attack off, the hacker had to gain access to Samsung and Oxford University servers, meaning he had time to understand their inner workings, allowing him to go unnoticed.”
Click to expand...

Finkelsteen revealed that the hackers had found a way to abuse one of the university’s SMTP servers – an application that serves to send, receive and relay outgoing email between senders and recipients.
Using legitimate University of Oxford SMTP servers let the cyber criminals effectively bypass the reputation checks that would usually be required by security measures at the sender domain.
Click to expand...

Check Point: Office 365 Phishing Campaign Exploits Samsung, Adobe and Oxford Servers

Recently, a seemingly unsophisticated Office 365 phishing campaign caught our attention. The attackers abused an Adobe Campaign redirection mechanism, using a Samsung domain to redirect victims to an O365 themed phishing website. The hackers took advantage of the fact that access to a reputable domain, such as Samsung’s, would not be blocked by security software.

To expand their campaign, the attackers also compromised several websites to inject a script that imitates the same mechanism offered by the Adobe redirection service. Further investigation revealed that the actors behind the campaign implemented a few other interesting tricks to hide the phishing kit and avoid detection at each stage of the attack.
Click to expand...

This report will describe what we discovered about this Office 365 phishing campaign which used trusted services to allow a new attack.
Click to expand...

Log in or Sign up

Office 365 Phishing Campaign Exploits Samsung, Adobe and Oxford Servers

guest Guest

Log in or Sign up

Office 365 Phishing Campaign Exploits Samsung, Adobe and Oxford Servers

guest Guest

Useful Searches