Friday, June 14, 2024

Beware of Fake Microsoft Teams Notifications Aimed to Steal Employee’s Passwords

A new phishing campaign aimed to steal employees’ login credentials by impersonating Microsoft Teams’ notifications.

Due to this COVID-19 pandemic situation, many companies moved to full-time remote work, and attackers took advantage of it.

Fake Microsoft Teams Notifications

Attackers use crafted emails that appear to be automated notification emails coming from Microsoft Teams.

Once the user clicks on the email it takes them to the fake landing that impersonates the real web pages of Microsoft Teams.

The campaign was observed by Abnormal Security, according to researchers the “sender email originates from a recently registered domain, “”, which is not associated with either Microsoft or the IRS.”

Malicious Email

Attackers used numerous URL redirections to evade malicious link detection and hide the original URL used to launch the attack.

Researchers observed two such attacks that try to steal employee login credentials

  1. In one such attack, the email includes a link to a document that contains an image that urges recipients to log in with Microsoft Team, upon clicking the image it takes to the fake Microsoft Office login page.
  2. In another, a Youtube link is redirected multiple times and reaches a final webpage that impersonates a Microsoft login page.

If a recipient falls victim to the attacks, their login credentials get compromised, and attackers may gain access to Microsoft Office 365 services also. The attack targets more than 50,000 employees to steal login credentials.

Recently Group-IB Threat Intelligence group reported that “more than 150 companies’ top executives are hacked via successful targeted phishing attacks, they also got evidence regarding the corporate email account establishment of an Asia-based company.”

Last week Microsoft patched a subdomain takeover vulnerability in Microsoft Teams that affects every user who uses the Teams desktop or web browser version.

Since the lockdown was introduced remote traffic is increased, and attackers taking advantage of the situation to steal corporate resources. Stay Safe Online!!

You can follow us on LinkedinTwitter, and Facebook for daily Cybersecurity and hacking news updates.

Also, Read

Malicious App in Google Play Store Hijack SMS Message Notifications to Commit Billing Fraud

New Android Malware that Uses Chrome to Load Malicious Websites through Notifications

Fake cryptocurrency Wallets Apps on Google Play Steal User Credentials and Mimic Legitimate Wallets


Latest articles

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these...

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a...

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes.Resecurity...

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million...

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery...

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection...

Hackers Exploiting MS Office Editor Vulnerability to Deploy Keylogger

Researchers have identified a sophisticated cyberattack orchestrated by the notorious Kimsuky threat group.The...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles