Beware of the Data-Stealing Microsoft 365 Phishing Scam
Researchers with security company Cofense have published a report detailing an ongoing phishing campaign that is targeting US government contractor entities.
According to the Cofense team, this type of campaign has been active with interruptions in some form since the middle of 2019. The campaigns are characterized by a high level of polish and attention to detail that is not seen in most phishing attacks and attacks have been spotted in systems that are behind secure email gateways, implying an unusual level of sophistication.
The scam emails are posing as emails from the US Department of Labor and contain an attachment that poses as an "invitation for bid". To lend further credibility to the phishing emails, the threat actors behind them started using .gov domain names for the sender. The latest evolution of the ongoing scam also uses links to fake documents instead of attaching them in the email.
The fake bid invitation culminates with a button that just says "BID". Clicking this opens a malicious website that also uses a domain extension that makes it appear legitimate or run by the government. The phishing login form claims that it only works with Microsoft Office login details. Once credentials are entered, the scammers ask for re-entry to "verify" the data. The phishing process ends in a captcha-like text entry box.
Of course, entering MS Office login credentials in this form will simply siphon them to the entity running the scam. Given the sophistication of similar scams, employee training and limiting human error as much as possible remain crucial.
