Recent phishing attacks reportedly capitalize on Office 365 security holes

itman · Aug 26, 2017

Nothing new; instant Microsoft denial.

Researchers from cloud security company Avanan have reported finding two ways that phishers are evading Microsoft Office 365 Security protections: one using "hexidecimal escape characters" to conceal coding and links, and the other by compromising SharePoint files.

The first method involves emails with an HTML attachment that contain a small excerpt of JavaScript that is obscured in hexadecimal escape characters. "Therefore, no links are visible, but when opened, it presents a locally-generated phishing page with login instructions," the company explains in an Aug. 24 blog post.

According to a second Avanan blog post, the attack that abuses SharePoint generally involves an email that leverages "a genuine invoice from a commonly used online site, with a publicly open link to Office 365 SharePoint," which is a web-based, collaborative platform for Microsoft Office users. Clicking the link executes a JavaScript-based file that infects the endpoint.

“We disagree with Avanan's claims," said a Microsoft spokesperson in a statement emailed to SC Media. "Microsoft's filters do not rely on the specific techniques described in the vendor post, and our solutions regularly detect and flag these kinds of attacks.
Click to expand...

https://www.scmagazine.com/recent-p...-on-office-365-security-holes/article/684453/

Log in or Sign up

Recent phishing attacks reportedly capitalize on Office 365 security holes

itman Registered Member

Log in or Sign up

Recent phishing attacks reportedly capitalize on Office 365 security holes

itman Registered Member

Useful Searches