Phishing Attack Uses Azure Blob Storage to Impersonate Microsoft

guest · Oct 3, 2018

Phishing Attack Uses Azure Blob Storage to Impersonate Microsoft
October 3, 2018
https://www.bleepingcomputer.com/ne...-azure-blob-storage-to-impersonate-microsoft/

Azure Blob storage is a Microsoft storage solution that can be used to store unstructured data such as images, video, or text. One of the advantages of Azure Blob storage is that it accessible using both HTTP and HTTPS, and when connecting via HTTPS, will display a signed SSL certificate from Microsoft.

When users click on this link they will be brought to a HTML page pretending to be a Office 365 login form that is stored on the Microsoft Azure Blob storage solution. [...] As this page is also being hosted on a Microsoft service, it gets the benefit of being a secured SSL site as well.

For those users who may be suspicious of the strange URL, if they look at the certificate they will see that the page is signed by a SSL certificate issued by Microsoft IT TLS CA 5.

While more experienced users may not fall for this attack due to the strange URL, others may be more convinced because the page utilizes a certificate from Microsoft and thus must be safe.
Click to expand...

guest · Oct 4, 2018

mood said: ↑

Phishing Attack Uses Azure Blob Storage to Impersonate Microsoft
October 3, 2018
https://www.bleepingcomputer.com/ne...-azure-blob-storage-to-impersonate-microsoft/
Click to expand...

Phishing Attacks Distributed Through CloudFlare's IPFS Gateway
October 4, 2018
https://www.bleepingcomputer.com/ne...distributed-through-cloudflares-ipfs-gateway/

After reviewing the URLs utilized by the same attacker, BleepingComputer noticed that these same bad actors are also utilizing the Cloudflare IPFS gateway for the same purpose.

Last month Cloudflare released an IPFS gateway that allows users to access content stored on the IPFS distributed file system through a web browser. As part of this implementation, all connections to the IPFS gateway are secured using SSL certificates issued by CloudFlare.

The benefit of doing this is that the forms will then be secured using a SSL certificate issued by a well known company like Cloudflare, which could help to convince users that the form is legitimate.
Bad actor uses a wide array of phishing attack
This attacker has been involved in numerous phishing schemes since July 2018. When using VirusTotal to get a list of known URLs related to the searchurl.bid domain, you can see numerous phishing form submission pages.
Click to expand...

guest · Aug 21, 2019

Phishing Attacks Scrape Branded Microsoft 365 Login Pages
Augsut 21, 2019
https://www.bleepingcomputer.com/ne...cks-scrape-branded-microsoft-365-login-pages/

An unusual new phishing campaign is probing email inboxes via attacks using the targets' company-branded Microsoft 365 tenant login pages to add more legitimacy to the scam.

The attackers are also using Microsoft's Azure Blob Storage and Microsoft Azure Web Sites cloud storage solutions to host their phishing landing pages, a common tactic used by phishers to trick their targets into thinking that they're seeing an official Microsoft login page.
Using Azure Blob Storage object storage solution [1, 2] to host their phishing pages allows them to take advantage of the fact that they will automatically get signed with an SSL certificate from Microsoft.
Automated scraping of company-branded resources
"[The campaign] utilizes a novel method of scraping organizations’ branded Microsoft 365 tenant login pages to produce highly convincing credential harvesting pages," detail researchers part of Rapid7’s Managed Detection and Response (MDR) services team.
Click to expand...

Rapid7: How Attackers Can Harvest Users’ Microsoft 365 Credentials with New Phishing Campaign

Log in or Sign up

Phishing Attack Uses Azure Blob Storage to Impersonate Microsoft

guest Guest

guest Guest

guest Guest

Log in or Sign up

Phishing Attack Uses Azure Blob Storage to Impersonate Microsoft

guest Guest

guest Guest

guest Guest

Useful Searches