Microsoft 365 Vulnerability Let Hackers Bypass Anti-phishing Feature

A vulnerability in Microsoft 365 (formerly Office 365) has been found that allows malicious actors to bypass anti-phishing measures.

One of the anti-phishing features available in Exchange Online Protection (EOP) and Microsoft Defender to Office 365 enterprises is the ‘First Contact Safety Tip.’

In the first contact safety tip, users are cautioned when they get an email from a sender that they don’t typically communicate with.

Since the First Contact Safety Tip is appended to the HTML email body, you can use Cascading Style Sheet (CSS) style tags to change how the tip is displayed.

Are you from SOC and DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Free Access

As a result, experts have developed an approach in this scenario that “hides” the First Contact Safety Tip from the user.

Keeping The Safety Tip Hidden

when users receive an email from a sender with whom they don’t normally interact. Outlook displays an alert stating, “You don’t often get emails from xyz@example.com.”

Researchers demonstrate an HTML email that “hides” the user’s access to the First Contact Safety Tip. 

Even though the inline CSS in the elements or the rendering engine Outlook uses don’t seem to support applying some more common CSS rules like display: none, height: 0px, and opacity: 0 to the table itself, it is still possible to change the background and font colors to white to make the alert practically invisible.

“It is possible to change the background and font colors to white so that the alert is effectively invisible when rendered to the end user viewing the email”, Certitude researchers shared with Cyber Security News.

The alert will no longer appear in the email body when this HTML code is used in an email!

Beyond that, experts spoof the icons that Microsoft Outlook includes to encrypt and/or sign emails.

After receiving reports about these issues, Microsoft decided not to fix this behavior.

Microsoft MSRC stated, “We determined your finding is valid but does not meet our bar for immediate servicing, considering this is mainly applicable to phishing attacks.

However, we have still marked your finding for future review as an opportunity to improve our products”.

How to Build a Security Framework With Limited Resources IT Security Team (PDF) - Free Guide