Voicemail Phishing Campaign Tricks You Into Verifying Password

guest · Jan 23, 2019

Voicemail Phishing Campaign Tricks You Into Verifying Password
January 23, 2019
https://www.bleepingcomputer.com/ne...-campaign-tricks-you-into-verifying-password/

According to research shared with BleepingComputer by email security firm EdgeWave, a phishing campaign is underway that pretends to be a voicemail received through RingCentral.
These emails are using subjects such that include "Voice:Message", "Voice Delivery Report", or "PBX Message" and an example of one of these phishing emails can be seen below.

By using EML attachments, when a user clicks on them in Outlook they will be displayed as a preview in the Outlook client rather than being opened in their own Window as shown below. This makes it easier to coerce users into clicking on the links.

An interesting feature about this campaign is that it will always state you entered the wrong password and prompt you to enter it again. They do this to trick you into entering your password a second time to confirm your password for the phishers.
Click to expand...

guest · Aug 15, 2019

Microsoft Voicemail Notifications Used As Bait in Phishing Campaign
August 15, 2019
https://www.bleepingcomputer.com/ne...ifications-used-as-bait-in-phishing-campaign/

A newly spotted phishing campaign uses Microsoft voicemail notifications as baits to trick targets into opening HTML attachments that redirect to the attackers' landing pages using a meta element.

These phishing emails instruct the targets to open the attachments to be able to listen to the voice messages, displaying the caller number and voicemail length within the message to look more convincing.
The meta refresh redirections
The victims will be sent to the phishing landing pages employing a known redirection technique that uses the meta HTML element with the value of the http-equiv attribute set to "Refresh" and the value of the content attribute set to "1" to force a one-second timeout.

"These malicious HTML attachments use meta refresh to redirect the end-user from an HTML attachment hosted locally to a phishing page hosted on the public internet," says Avanan.
Collecting Office 365 credentials
This phishing form asks the targets to enter their Microsoft account's email address and password that will be collected and sent to an attacker-controlled server.
Click to expand...

Avanan: MetaMorph HTML Obfuscation Phishing Attack

guest · Sep 26, 2019

Voicemail as bait
September 26, 2019
https://www.kaspersky.com/blog/fake-voicemail-spam/28727/

Recently, we have been tracking a large-scale spam campaign in which scammers send e-mails that appear to be voicemail notifications. The body of the message indicates the time and length of the voice message, as well as a preview in the form of a hanging sentence: “Just checking to remind you in regards to our ….” The phrase is the same for all victims, and is intended only to generate interest.

Tapping the Sign in button triggers a script that the scammers try to hide from antimalware solutions using Base64 encoding. It saves any data the user enters in the authentication form, then passes it to a fraudulent site. After the data transfer, the user is redirected to a page with a description of a real voice-messaging service for business. That last step is an attempt to distract the victim from any last-second suspicions they may have.

The purpose of the attacks seems to be to gain access to important business correspondence and confidential commercial data.
Employees tend to view any such message as legitimate, perhaps even a priority.
Click to expand...

guest · Oct 31, 2019

New Office 365 Phishing Scams Using Audio Voicemail Recordings
October 31, 2019
https://www.bleepingcomputer.com/ne...shing-scams-using-audio-voicemail-recordings/

Ongoing phishing scams have been spotted targeting Microsoft Office 365 with partial audio voicemail messages to convince targets that they need to login to hear the full recording.

While using actual audio recordings in voicemail phishing scams is not new, researchers from McAfee have recently seen an uptick in their usage by various phishing kits targeting Microsoft Office 365 credentials.

"Over the past few weeks McAfee Labs has been observing a new phishing campaign using a fake voicemail message to lure victims into entering their Office 365 email credentials," McAfee researchers stated. "At first, we believed that only one phishing kit was being used to harvest the user’s credentials. However, during our investigation, we found three different malicious kits and evidence of several high-profile companies being targeted. "
These phishing kits include two being actively sold on the dark web and through social networks called "Voicemail Scmpage 2019" and "Office 365 Information Hollar", while the third did not have a name associated with it or any indication of who created it.
Click to expand...

This is why it is more important than ever to examine the URLs of any landing pages that contain Microsoft login forms and to remember that legitimate login forms will be on the microsoft.com, live.com, and outlook.com domains.
Click to expand...

Mcafee: Office 365 Users Targeted by Voicemail Scam Pages

guest · Jun 6, 2020

100,000 company inboxes hit with voice message phishing
June 5, 2020
https://www.bleepingcomputer.com/ne...pany-inboxes-hit-with-voice-message-phishing/

Attackers have been pounding employee inboxes at companies that still use private branch eXchange (PBX) telephone systems for communication, delivering phishing that bypasses email defenses.
The messages pretended to be voicemail notifications from PBX integrations and featured custom subject lines to pass a superficial legitimacy test.
Custom subject line
A fairly sophisticated phishing campaign in mid-May took advantage of this setup to deliver fake email notifications for voice messages in an attempt to steal login credentials.

Email security company IronScales caught almost 100,000 such phishing attempts “targeting hundreds of enterprises across all industries, including real estate, oil & gas, engineering, IT, healthcare, financial services and more.”
Click to expand...

Ironscales: Phishing Attacks Spoofing PBX Integrations

However, attackers know that the credentials could be used for multiple other logins, including for websites with valuable PII or business information. In addition, any sensitive information that is left in the voicemail could potentially be used for a social engineering attack.
Click to expand...

Log in or Sign up

Voicemail Phishing Campaign Tricks You Into Verifying Password

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Voicemail Phishing Campaign Tricks You Into Verifying Password

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches