Zoom Themed Phishing Attack Steal Victims’ Microsoft User Credentials

Researchers at Armorblox unveiled the hot phishing assault, the keep scammers spoofed Zoom users to take their Microsoft switch credentials.

This assault focused Nationwide Healthcare Firm aiming bigger than 21,000 mailboxes bypassing Microsoft Exchange Email Security. Microsoft Exchange Server is a mail and calendaring server ragged by hundreds of thousands of companies worldwide. This makes it a money-spinning map for cybercriminals.

“The electronic mail assault had a socially engineered payload, bypassed Microsoft Exchange email safety, and would had been delivered to over 21,000 users”, philosophize Armorblox researchers.

Credential Phishing Email Attack Drift

To originate a blueprint of belief within the victim, this email assault impersonated a acknowledged ticket. Therefore, the attackers ragged legit logos and firm branding at some level of the malicious email. Critically they incorporated unsuitable touchdown web page, in pronounce to exfiltrate the victims’ composed PII data.

Researchers philosophize the electronic mail became as soon as titled “[External] For title of recipient on Presently time, 2022”, with every client’s exact title listed because the recipient. The body of the electronic mail claimed the recipient had two messages that had been awaiting a response.

The body of the electronic mail holds two defective URLs – one associated with the predominant name-to-movement button and the diverse became as soon as shadowed as an unsubscribe hyperlink.

“The electronic mail incorporated a Zoom logo at the high in pronounce to instill belief within the recipient that the electronic mail communication became as soon as a exact industry email communication from Zoom – in preference to a focused, socially engineered email assault”, Armorblox researchers

The electronic mail took victims to a unsuitable touchdown web page which seemed identical cherish a exact Microsoft login web page. Then, the victims had been brought about to enter his or her Microsoft narrative password (composed PII data).

Critically, the possibility attackers ragged a exact domain, which displayed a ‘trustworthy’ reputation salvage with only one an infection reported within the last one year.

“The electronic mail assault bypassed native Microsoft Exchange email safety controls because it handed all email authentication checks: DKIM, SPF, and DMARC”, Armorblox

Armorblox posthaste acted and blocked the emails from reaching unsuspecting recipients. Therefore, researchers recommended organizations to crimson meat up constructed-in email safety with layers that rob a materially diverse potential to possibility detection.

Moreover, be cautious of social engineering cues and implement multi-aspect authentication and password management finest practices to reduce again the influence of credentials being exfiltrated.

Cyber Attack with Zero Have faith Networking – Download Free E-Book