Phishing scams use legit cloud services and collaboration apps for cover

guest · Jul 23, 2021

Phishing scams use legit cloud services and collaboration apps for cover
July 22, 2021
https://www.scmagazine.com/analysis...oud-services-and-collaboration-apps-for-cover

Cybercriminals are abusing cloud-based collaboration tools to improve the elusiveness and efficacy of their phishing campaigns – including one app that threat actors have abused so extensively that hyperlinks to its cloud-based service almost qualify to be blocked as a malware threat, according to one email security company.

In a blog post Thursday, researchers at Avanan reported scammers have been sending emails containing a link to a page from note-taking app Milanote; this page leads to a second link that, if clicked, directs users to a phishing page. In fact, Avanan reported that out of the last 1,430 most recent emails it observed citing a Milanote reference or link is used, 95.5% of them were created for phishing purposes.
Click to expand...

Friedrich said he can’t recall ever seeing a more disproportionate ratio of legitimate links to malicious links when investigating a cloud-based service.

In its blog post, Avanan said “it’s easy to imagine this attack method reaching other popular cloud-based collaboration apps, potentially causing major damages to companies of all sizes and industries.” Indeed, Gallop from Cofense noted that Milanote abuse “is consistently accompanied by abuse of similar cloud services and collaborative platforms.”

“In June, Milanote-based credential phishing links were most commonly observed in conjunction with Glitch.me and OneDrive links,” Gallop continued.
Click to expand...

Avanan: New Attack Leverages Milanote to Host Phishing Content

One of these apps that’s quite popular is Milanote. It’s billed as a note-taking and collaboration app for creatives.
Hackers have noticed, which is why Avanan analysts have noticed a dramatic increase in attacks utilizing files hosted on Milanote.
Click to expand...

First, it’s a simple email with an invoice attached: [...] When you click on “Open Docs” you get directed to the page in Milanote: [...]
Other services use static scanners to scan attachments or links for malicious payloads. In response, hackers are bypassing those detection mechanisms by nesting the payloads in deeper layers within legitimate services, fooling the static scanners.

This is part of a larger trend of hackers utilizing legitimate services to host malicious content.
Click to expand...

Log in or Sign up

Phishing scams use legit cloud services and collaboration apps for cover

guest Guest

Log in or Sign up

Phishing scams use legit cloud services and collaboration apps for cover

guest Guest

Useful Searches