Hackers Abuse Trusted Websites in New Attacks on Microsoft Teams Users

Threat actors are increasingly turning to trusted infrastructure to launch their attacks, making it harder for automated security tools to flag malicious activity.

A newly identified phishing campaign highlights this growing trend by abusing compromised websites to harvest valuable corporate credentials.

Cybersecurity researchers have uncovered a sophisticated new phishing campaign where attackers hijack legitimate websites to steal sensitive user data.

According to recent threat intelligence shared by KnowBe4 Threat Labs, malicious actors are actively exploiting compromised WordPress infrastructure to host highly convincing fake login pages.

The multi-layered campaign primarily targets Microsoft Teams users, alongside individuals holding Xfinity and UAE Pass accounts.

By embedding their malicious infrastructure within trusted, previously established websites, the attackers successfully bypass many standard email security filters.

This tactic allows the threat actors to easily deceive unsuspecting victims who might otherwise notice suspicious web addresses.

Rather than relying on a single, easily identifiable tactic, the attackers are deploying a multi-vector approach.

The Attack Chain Process

They utilize three distinct social engineering lures designed to manufacture a false sense of urgency. The threat actors trap their victims using the following methods:

• Microsoft Teams Voice Messages: Targeted users receive an authentic-looking email notification falsely claiming they have a missed voicemail waiting on Microsoft Teams.
• Shared Document Alerts: A fraudulent notification stating that an important new document has been shared with the user, prompting them to review it immediately.
• UAE Pass Spoofing: A geographically tailored lure using fake login requests designed to steal regional credentials from users in the United Arab Emirates.

The effectiveness of this phishing campaign relies on a highly structured, four-step attack chain.

This streamlined process seamlessly moves the victim from a deceptive email inbox directly to a compromised web server.

KnowBe4 Threat Labs outlined the precise sequence of events driving these ongoing attacks:

• The Hook: The attack initiates when a targeted user opens a deceptive email, such as the fake Teams voicemail alert, and clicks the prominently displayed “Listen Now” action button.
• The Pivot: Clicking the malicious link triggers a swift, automated redirect through an intermediary tracking domain, specifically identified by researchers as skimresources[.]com.
• The Payload: The victim ultimately lands on a pixel-perfect replica of a Microsoft Teams, Xfinity, or UAE Pass login portal hosted securely on hijacked WordPress backend directories.
• The Goal: If the target manually enters their username and password, the attackers immediately harvest the credentials to facilitate downstream account takeovers and infiltrate corporate environments.

Indicators of Compromise

To evade routine security scans, the threat actors intentionally conceal their phishing payloads deep within the standard file structures of hijacked websites.

They specifically abuse legitimate backend directories, such as the /wp-includes/ and /bin/ folders, seamlessly blending in with normal website operations.

Network defenders and security administrators should actively monitor their environments and block the following active Indicators of Compromise (IOCs):

• crsons[.]net/wp-includes/js/tinymce/~
• crsons[.]net/wp-includes/cgi/UAE%20PASS.htm
• afghantarin[.]com/afghantarin/admin/waitme/~
• medinex[.]in/includes/bin/index[.]php
• cabinetzeukeng[.]net/config/[.]bin/voicemail
• rnedinex[.]com

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.