Microsoft 365 ATP
Microsoft 365 EOP JTNDc3R5bGUlM0UlMEF0YWJsZSUyMCUyQSUyMCU3QiUwQSUyMCUyMCUyMCUyMGZvbnQtc2l6ZSUzQSUyMDE2cHglMjAlMjFpbXBvcnRhbnQlM0IlMEElMjAlMjAlMjAlMjBmb250LXdlaWdodCUzQSUyMDMwMCUyMCUyMWltcG9ydGFudCUzQiUwQSUyMCUyMCUyMCUyMGNvbG9yJTNBJTIwJTIzMzMzJTNCJTBBJTdEJTBBJTNDJTJGc3R5bGUlM0U=By Kian Mahdavi, Cofense Phishing Defense Center
The Cofense Phishing Defense Center (PDC) has discovered a recent phishing campaign that has targeted Office 365 users and includes a convincing Microsoft quarantine notification reference. The campaign was found in an environment protected by Microsoft’s own secure email gateway (SEG).
Threat actors continue to leverage standard Microsoft notifications to entice the recipient into interacting with the email. We noticed two variants of this campaign.
The first example displayed above in Figure 1 showcases a fairly persuasive “Digest Summary Notification.” It displays the same HTML used within the legitimate notifications sent. However, if we look past the display name and dive a little deeper into the actual “from” address, we can see that it belongs to a compromised account belonging to an environmental firm: [email protected] [.]com. We can only assume the attacker was hoping the reader wouldn’t notice the domain has no relation to Microsoft.
The example in question also illustrates a move away from the traditional narrative used to lure recipients. This attacker has opted out of using urgency language with terms such as “urgent” or “you must.” As a result, the reader may overlook the threat and become curious enough to engage with the email, opting to review the “important message.”
Should the user hover over the “Review” option, the URL path will clearly display the redirect that has no relation to Office or Microsoft. It will instead direct the user to “googleads,” taking them immediately to the phishing landing page. We can assume the reason for this is to evade detection and bypass existing security measures with whitelisted URLs.
Figure 2 – Encoded body of email
The second campaign is a little more unusual at first glance as the entire email body has been encoded. The attacker may have done this to evade existing security controls, assuming that, once the email was opened, it would decode to reveal the email message in plain text. The email message did not decode, revealing a rather confusing layout and raising red flags immediately. This may have been caused by a bug in the threat actor’s toolkit. We later decoded the text to reveal several links of which most were benign, to which we narrowed down the malicious link through trial and error that led to the matching phishing landing page below:
hXXps://authsignin[.]website[.]yandexcloud[.]net/
As seen above in Figure 3, the phishing landing page has been carefully designed to replicate the official Office 365 login page, luring users into thinking they are authenticating via a genuine service. Assuming users logged in with their true Microsoft credentials, their personal data could unfortunately be in the hands of the threat actor.
Attackers are always exploring new sophisticated tools and techniques, as demonstrated in the above examples, to bypass the SEG. Cofense PDC uses human detection and auto response to remediate and quarantine such threats, and continues to evolve to stay ahead of the latest phishing and malware threats.
Indicators of Compromise
Network IOC | IP |
hXXps://googleads[.]g[.]doubleclick[.]net/pcs/click?xai=AKAOjssIdZGtK2LGw4coQMwtQcONuf8cVZUVHUrlFgT33_wiLCuxpoweUvHdBH9neY4iW-CZh2SzgITptx6j64F0B2pEU0uoeRfmKTeyn7LSG5Irubqjv6IFl9MeqTp84ZT99WRJlZDMgrwUaUI7QjgNwL22AVveJm980wuVNryiILT2WhxCPmcY8M7PVIOygAXT_382p7PUn7bIByn2OjlTfCiaqta3tAhZWCuROeXZPznm5cGhgUYspVywPb8Y8GbuT5pyEUyF89icmqe5zg&sig=Cg0ArKJSzFtr0kI2Y6Ll&adurl=https:%2F%2Fauthsignin.website%E2%80%8B.yandexcloud.net%23 | 172[.]2177226 |
hXXps://authsignin[.]website[.]yandexcloud[.]net/ | 213180193247 |
hXXps://auth-1304164361[.]cos[.]ap-seoul[.]myqcloud[.]com/index.html | 119[.]28148128
11928148172 11928148150 |
hXXps://authsignin[.]website[.]yandexcloud[.]net/ | 213180193247 |