There’s a new Microsoft 365 phishing attack spreading, and it’s been discussed in detail in the latest report from email security service Vade. The group’s Threat Intelligence and Response Center (TIRC) was able to gather information about the attack and discovered that it was carried out using an email containing a malicious HTML attachment with JavaScript code. Here’s what we know about the attack and how you can stop it coming your way.
CLICK TO GET KURT’S FREE CYBERGUY NEWSLETTER WITH SECURITY ALERTS, QUICK TIPS, TECHNICAL ADVICE AND EASY FEEDBACK TO MAKE YOU SMARTER
How does this Microsoft 365 phishing attack work?
The attack process starts when someone receives the above mentioned email with the malicious HTML attachment with JavaScript code. If that person opens this attachment, they will open a phishing page that looks like the person has been signed out of their Microsoft 365 account and needs to sign in again to view the file. It is designed to mimic the Microsoft 365 login interface with the logo. Here, the person will be asked to enter their credentials, such as email address, phone or Skype number, and then their password so that hackers can steal the credentials. Once phished, the login credentials are then sent directly to the threat actors.
We reached out to Microsoft for comment on this phishing attack targeting Microsoft 365, but did not hear back by the deadline for this article to be published.
Hackers exploit glitch.me to host malicious domain
Hackers used the glitch.me website to host these phishing pages, including the malicious domain known as eevilcorponline. Glitch.me is generally used innocently for people to create things like websites and other online projects.
THE SPREAD OF TROUBLED MALWARE THREATS ON FACEBOOK AND TWITTER
The same team also uncovers an Adobe phishing attack
While researching the Microsoft 365 phishing attack, Vade’s team also uncovered a phishing attack that posed as a legitimate version of Adobe. Adobe, for those who don’t know, is a renowned software company specializing in the creation of multimedia and creativity tools, widely known for products such as Photoshop, Illustrator and Acrobat.
LAS VEGAS, NEVADA – JANUARY 06: Microsoft Corporation booth signage is displayed at CES 2023 at the Las Vegas Convention Center on January 6, 2023 in Las Vegas, Nevada. CES, the world’s largest annual consumer technology trade show, runs through January 8 and features approximately 3,200 exhibitors showcasing their latest products and services to more than 100,000 attendees. ((Photo by David Becker/Getty Images))
Vade found an email claiming to be from Adobe. The email attempted to trick people into giving up their personal information. Vade looked at the email and found secret codes that helped them better understand the scam. They found a website called “ultimotempore[.]online” that was trying to trick people. They also found another website.
What can I do to protect myself?
Protecting yourself from phishing attacks like the two mentioned above can be daunting; However, there are a few key signs you can spot for yourself and services that can help. Here are some of my tips.
NEW MALICIOUS SOFTWARE TARGETING MACOS AND CAN STEAL SENSITIVE INFORMATION ON YOUR DEVICES
Do not open any suspicious attachments
If you receive an out-of-the-box email asking you to open an attachment or click on a random link, don’t be fooled. Hackers will often try to use urgency in their emails to make you feel like you need to do what they say, so use your judgment, and if anything seems fishy, don’t trust it.
Beware of emails asking you to enter your login details
If you receive an email asking you to enter your login information, be careful. It is better to go directly to the website in question and connect to it than to click on a link in an email.
Use anti-virus software
It is possible to prevent hackers from accessing your devices if you have good antivirus software installed. Having anti-virus software on your devices will prevent you from clicking on potential malicious links that could install malware on your devices, giving hackers access to your personal information.
See my expert opinion on the best virus protection for your Windows, Mac, Android and iOS devices heading towards Cyberguy.com/LockUpYourTech
Fake version of Microsoft 365 (Go of)
NEW MALWARE SPECIFICALLY TARGETS IPHONES
Verify email address
Some hackers will try to impersonate representatives of big companies like Microsoft and Adobe to trick you into thinking they are legit. Before clicking on anything or opening attachments, check the sender’s email address and search for it yourself. These big companies will have official email addresses, so if this one doesn’t match, you know you’re dealing with a fake.
Kurt’s main takeaways
Phishing attacks are something we’ve talked about often and still remain a serious threat and a way for cybercriminals to distribute malware. Unfortunately, they won’t be stopping anytime soon. However, that doesn’t mean you have to fall victim to it. By following the tips mentioned above, you can protect yourself. So, stay alert and keep your guard up against these deceptive schemes to stay ahead of these scammers.
Do you feel that security issues are increasing or under control? Why do you think it’s often small cybersecurity companies that end up discovering these issues? Let us know by writing to us at Cyberguy.com/Contact.
Fake version of Adobe (Go of)
CLICK HERE TO GET THE FOX NEWS APP
For more of my security alerts, subscribe to my free CyberGuy Report newsletter by going to Cyberguy.com/Newsletter.
Copyright 2023 CyberGuy.com. All rights reserved.