A new phishing campaign based on legitimate servers from Microsoft's SharePoint platform is targeting at least 1600 people across Europe, the US and other regions around the world, using a native notification mechanism.
The campaign was detected and analyzed by Kaspersky researchers , who reported that cybercriminals were targeting email accounts , including Yahoo!, AOL, Outlook, Office 365, and others.
According to Roman Dedenok , a fraud analysis expert, the victim employee receives a standard notification about someone sharing a file. “This is unlikely to raise suspicions […] because it is a real notification.”
See also: Mobile phishing attacks broke all records in 2022
Once the victim clicks on the link, they are taken to a genuine SharePoint server hosting a OneNote. This includes another link, which is the malicious link.
This link, in turn, opens a typical phishing website that mimics the OneDrive login page. From there, credentials for Yahoo!, AOL, Outlook, Office 365, or another email service can be easily stolen.
According to Kaspersky, this is not the first time that phishing campaigns exploiting SharePoint have been detected. However, the attack methodology is new, as it hides the phishing link on a SharePoint server and then distributes it through the platform.
See also: Outdated Windows UAC bypass allows phishing campaigns
“All the attackers have to do is gain access to someone else’s SharePoint server […] So, they upload the file with the link and add a list of emails to share it with. SharePoint itself notifies the email,” the researcher says.
Kaspersky recommends that system defenders train employees in phishing techniques and ensure their cybersecurity awareness so they can identify potential threats.
See also: A phishing attack can cost a business $1 million
Phishing remains a significant threat in cyberspace and is unlikely to go away anytime soon. However, by taking some precautions, such as regularly updating your software, having a strong security , and training in basic security practices, you can avoid falling victim to phishing attacks. Remember, always be on the lookout for anything suspicious and report it to the appropriate department in your business if you think you have come across a phishing attempt.
Source: www.infosecurity-magazine.com
