A new phishing scam that relies on legitimate servers for Microsoft’s collaboration platform SharePoint uses native notification mechanisms to target at least 1,600 individuals in Europe, the United States, and other countries.
Kaspersky security researchers explain their findings in a new advisory released today, showing that cybercriminals have used this scam to entitle various email accounts including Yahoo!, AOL, Outlook and Office 365. He added that he stole the information.
You can read more about Microsoft 365-focused attacks here: Microsoft 365 Apps continues to be the most exploited cloud service
Kaspersky Spam Analysis Expert Roman Dedenok writes: “This is unlikely to raise suspicion […] Because it’s a real notification.
Clicking on the link takes the victim to a real SharePoint server hosting a OneNote file containing another link. This is malicious.
“The link then opens a standard phishing site that mimics the OneDrive login page and easily steals credentials for Yahoo!, AOL, Outlook, Office 365 or other email services,” said Dedenok. is writing
According to Kaspersky, this isn’t the first time attackers have used SharePoint-based phishing. However, the attack method is new as it hides the phishing link on the SharePoint server and distributes it via the platform’s notification feature.
“This is possible because, thanks to Microsoft developers, SharePoint has the ability to share files on corporate SharePoint sites with external participants who may not have direct access to the server,” explains Dedenok.
“All an attacker would have to do is gain access to someone’s SharePoint server. […] Once that’s done, they upload the file with the link and add a list of emails to share it with.SharePoint itself provides helpful notifications to the email owner. ”
To protect against this phishing campaign, Kaspersky recommends that system defenders conduct regular security awareness training for their employees.
The phishing scam the company discovered comes weeks after Menlo Security researchers shed light on threat actors using OneNote to deliver malware.
