Large-Scale Phishing Attacks Targeting Microsoft Enterprise Email Services

Security researchers from ThreatLabz have uncovered a new strain of a big-scale phishing marketing campaign working with adversary-in-the-center (AiTM) techniques alongside with numerous evasion practices.

According to an advisory printed by the firm on Tuesday, similar AiTM phishing tactics had been made use of in a individual phishing marketing campaign described by Microsoft previous month.

Now, ThreatLabz revealed that employing intelligence gathered from the Zscaler cloud, it observed an boost in the use of innovative phishing kits in a large-scale campaign in June.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The security firm explained the new campaign stood out from “commonly seen” phishing attacks for a quantity of reasons.

For starters, just like the marketing campaign spotted by Microsoft, it utilized AiTM to bypass multi-factor authentication (MFA). Secondly, it used several evasion strategies across many stages of the attack developed to bypass typical email security and network security solutions.

In fact, based on the information analyzed by ThreatLabz, the firm believes the marketing campaign is specially created to arrive at close users in enterprises that use Microsoft’s email solutions. 

“Business email compromise (BEC) continues to be an at any time-current menace to organizations and this marketing campaign further more highlights the want to protect against these attacks,” the advisory browse.

According to ThreatLabz, all these phishing attacks start off with an email despatched to the victim with a malicious link, and the marketing campaign is lively at the time of composing, with new phishing domains being registered practically every single day by the threat actors.

“Based on our cloud data telemetry, the greater part of the qualified companies have been in the fintech, lending, finance, insurance, accounting, strength and federal credit history union industries,” ThreatLabz stated.

Also, the agency claimed most of the qualified organizations ended up located in the United States, the United Kingdom, New Zealand and Australia.

To safeguard against these attacks, ThreatLabz stated multi-factor authentication (MFA) really should be applied, but not be thought of a silver bullet.

“With the use of state-of-the-art phishing kits (AiTM) and clever evasion strategies, threat actors can bypass both of those classic as properly as superior security methods.”

As an excess precaution, ThreatLabz explained users should really not open attachments or click on one-way links in email messages despatched from untrusted or unidentified resources. 

“As a most effective apply, in common, buyers really should confirm the URL in the deal with bar of the browser right before getting into any qualifications.”