COVID-19 Status Update? Sounds Like Credential Theft.

Share Now

Facebook
Twitter
LinkedIn

Found in Environments Protected By: Symantec

By Adam Martin, Cofense Phishing Defense Center

As self-testing via antigen and professional testing via PCR have become more common across many sectors of society, so has status-based phishing. Just as COVID-19 guidelines have evolved, so have threat actor phishing tactics. This recent Office365 credential harvesting campaign utilizes the topic of potential repercussions if the status form isn’t completed. A classic tactic of creating panic in the end user, this ploy threatens financial or other penalties if a certain urgent task isn’t completed.

The phishing email for this campaign plays on fear and conveys urgency. It uses a relevant topic — COVID-19 – demanding completion of a form to disclose information, and it includes the threat of some form of reprisal for noncompliance. The email is tailored to the target organization, complete with branding. However, illustrated in Figure 1, the “Covid Form” button will direct the user outside of any authentic corporate environment. The initial “svc[.]dynamics” link will redirect the user to an external domain once the button is pressed.

Figure 1: Email Body

Figure 2: Phishing Page

The unsuspecting user, having clicked on the link, will be directed to the phishing page seen in Figure 2. As can be seen from the URL, this page is not a legitimate Microsoft website and the domain is being hosted from a Russian TLD (.ru). The information box is spoofed with target company branding along with the affiliation to Microsoft, shown in the tab logo. The most glaring giveaway is the URL base address, in tandem with the randomized look of the rest of the URL path.

The user is given the prompt to enter their password as “sensitive information” is being accessed. Once the password is entered, this information is exfiltrated to an external server. Another indicator of the illegitimacy of this service is the fact that there isn’t any typical email login option. We noted the absence of “have you forgotten your password,” “Contact” and any semblance of a help menu as would typically be seen with legitimate services. Regardless of the password entered, the page will return an error for incorrect password and run this error in a loop.

Figure 3: Whois Records

The sender address “Inf[email protected][.]net” found in Figure 1 and references in Figure 3 is relatively new. What also draws attention is the technical contact page. The contact address looks to be randomized, and the phone number is unusable.

As the world adapts to COVID, with different measures of detection and status declaration, so too adapts the world of credential phishing. As with most of the traffic seen here at the PDC, automated detection systems still underperform when compared to human analysis. With testing becoming more the norm, it is likely that phishing lures will exploit this trend. The driving factor behind the success of such a lure is the fact that a large number of employees are accessing or uploading these results for travel or other purposes. It’s not beyond the realm of possibility that a recipient would be panicked into revealing credentials if threatened with loss of access to work resources. Cofense continues to monitor these and disposition these threats. We can help your company, too. To find out how, contact us to learn more.

Indicators of CompromiseIP
hXXps://015e86e84bce4534a8a6f8e57cc4bd23[.]svc[.]dynamics[.]com/t/r/7HK
qRHWPuvayNfeu9O0COW3Y3T6s9OwbRCRs3Zuq1N4
104[.]40[.]78[.]147
hXXps://636500[.]selcdn[.]ru/scans3/bbdef085359361/covid_form.htm?
ioxwrxnaerll&auth=&7589cf-3ac6-4e1c-9e2a-
babd0161c3c4&utm_source=mail&utm_campaign=&utm_medium=u=589a04
49d04476c8af0f92bc7&id=ca92440317&e=c5cec25e50BgVtWAzsQmMcaL3z
BjzlZ2TJR&
92[.]53[.]68[.]201
92[.]53[.]68[.]203
92[.]53[.]68[.]202
92[.]53[.]68[.]205
92[.]53[.]68[.]204

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats. Past performance is not indicative of future results.

The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

 

Read More Related Phishing Blog Posts

Search

We use our own and third-party cookies to enhance your experience by showing you relevant content, personalizing our communications with you, and remembering your preferences when you visit our website. We also use them to improve the overall performance of our site. You can learn more about the cookies and similar technology we use by viewing our privacy policy. By clicking ‘Accept,’ you acknowledge and consent to our use of all cookies on our website.

This site is registered on wpml.org as a development site.