Microsoft Users Targeted in Phishing Campaign
While a bigger cyber war takes place in and around the conflict zone of the Russian invasion of Ukraine in Europe, it seems cybercriminals are doing their best to capitalize on the turmoil as well. A new phishing campaign is making the rounds, targeting Microsoft accounts, and name-dropping Russia in the text bait of the emails.
The campaign is attempting to persuade its victims that there has been illegal login activity on their Microsoft account. The full text of the phishing messages is relatively well-structured, compared to many other similar efforts, and doesn't have any glaring errors in it when it comes to grammar and syntax, except for minor typos that regular users might not notice.
Scammers attempt classic scare tactics
The phishing email warns the potential victim of "unusual sign-in activity". The fake infodump about the suspicious sign-in specifically lists Moscow, Russia as the origin of the suspicious login, likely in an effort to create a sense of urgency and tension in light of the global situation.
The message tells users the non-existent user managed to log into the Microsoft account successfully and that the system will consider this a safe and valid location if no action is taken. Of course, this is simply a little social engineering trick to create a sense of urgency and get the victim to act immediately to report the illegal login.
Uncertain outcomes, guaranteed headaches
There is a button provided further down in the email, offering to "report the user". However, according to researchers, clicking this will create a new message with a pre-filled title. The idea is to get the user to believe they are responding to Microsoft's real account support team. Obviously, this is not the case.
The exact attack vector that the scammers have gone for is not clear, but researchers expect anything from landing on phishing pages that attempt to harvest credentials to continued communication over email to further ensnare the victim and get them to trust the actors on the other end.
Just like with Covid over the past couple of years, the war in Ukraine and the tensions between the West and Russia will create a lot of similar opportunities for threat actors to play on people's anxieties and attempt to profit from them.
