Office 365 Zero-Day Used in Real-World Phishing Campaigns

guest · May 8, 2018

Office 365 Zero-Day Used in Real-World Phishing Campaigns
May 8, 2018
https://www.bleepingcomputer.com/ne...ro-day-used-in-real-world-phishing-campaigns/

A new zero-day vulnerability known as baseStriker allows miscreants to send malicious emails that bypass security systems on Office 365 accounts.

Discovered last week, on May 1, 2018, by security researchers from Avanan, baseStriker is a flaw in how Office 365 servers scan incoming emails.
Office 365 doesn't support the "base" HTML tag
The problem, according to Avanan, is that Office 365's security systems don't appear to support base URLs.

An attacker can simply send out a rich-text-formatted email with the following structure and Office 365 won't be able to scan and detect any malware hosted on the URLs.
baseStriker used in the wild
But baseStriker isn't just a random vulnerability that researchers found after weeks of pen-testing. Avanan says it discovered baseStriker as part of real-world attacks.
Click to expand...

Log in or Sign up

Office 365 Zero-Day Used in Real-World Phishing Campaigns

guest Guest

Log in or Sign up

Office 365 Zero-Day Used in Real-World Phishing Campaigns

guest Guest

Useful Searches