Office 365 phishing scam uses legitimate Oracle and AWS services Hook on Keyboard
A sophisticated phishing attack is underway that employs some high-profile legitimate services, including cloud solutions by Oracle and Amazon. The method puts a huge number of individuals at risk, whether they primarily use Windows 10, macOS, or mobile operating systems for work.
Security researchers at Mitiga initially discovered the scheme after one of its employees was targeted. The phishing scheme has been active for more than six months and works by using several legitimate websites as part of a proxy chain.
“This particular attack begins with the victim receiving a phishing email sent from a legitimate, but compromised, Office 365 email account,” the Mitiga security blog explains. “This email asks the targeted user to click a link for a voice mail message. Once the link was clicked, the user is redirected through several proxies, including AWS load balancers, all the way to a compromised website belonging to a genuine organization. Our team identified over 40 websites belonging to SMBs that were compromised by the associated threat actors.”
A sophisticated scam
Although the particular phishing campaign starts out like many others – with a fake or misleading email – it adds a layer of complexity by directing victims via a number of legitimate sites. Ultimately, the targeted individual is redirected to a fake Office 365 login page hosted on Oracle’s cloud infrastructure or on AWS S3 buckets.
Once a cyberattacker has acquired an individual’s Office 365 credentials, the victim is redirected to a legitimate but compromised website. The attacker, meanwhile, may use their ill-gotten credentials to gain further sensitive information about the individual or the organization that they work for.
By investigating the HTML code used to create the fake Office 365 page, Mitiga believes that the attack may be part of a phishing-as-a-service offering. Although it’s possible that the information used to come to that conclusion has been deliberately left to mislead security researchers.
A sophisticated phishing attack is underway that employs some high-profile legitimate services, including cloud solutions by Oracle and Amazon. The method puts a huge number of individuals at risk, whether they primarily use Windows 10, macOS, or mobile operating systems for work. Security researchers at Mitiga initially discovered the scheme…
