Beware of Fake Microsoft Teams Notifications Aimed to Steal Employee’s Passwords

A new phishing campaign aimed to steal employees’ login credentials by impersonating Microsoft Teams’ notifications.

Due to this COVID-19 pandemic situation, many companies moved to full-time remote work, and attackers took advantage of it.

Fake Microsoft Teams Notifications

Attackers use crafted emails that appear to be automated notification emails coming from Microsoft Teams.

Once the user clicks on the email it takes them to the fake landing that impersonates the real web pages of Microsoft Teams.

The campaign was observed by Abnormal Security, according to researchers the “sender email originates from a recently registered domain, “sharepointonline-irs.com”, which is not associated with either Microsoft or the IRS.”

Attackers used numerous URL redirections to evade malicious link detection and hide the original URL used to launch the attack.

Researchers observed two such attacks that try to steal employee login credentials

1. In one such attack, the email includes a link to a document that contains an image that urges recipients to log in with Microsoft Team, upon clicking the image it takes to the fake Microsoft Office login page.
2. In another, a Youtube link is redirected multiple times and reaches a final webpage that impersonates a Microsoft login page.

If a recipient falls victim to the attacks, their login credentials get compromised, and attackers may gain access to Microsoft Office 365 services also. The attack targets more than 50,000 employees to steal login credentials.

Recently Group-IB Threat Intelligence group reported that “more than 150 companies’ top executives are hacked via successful targeted phishing attacks, they also got evidence regarding the corporate email account establishment of an Asia-based company.”

Last week Microsoft patched a subdomain takeover vulnerability in Microsoft Teams that affects every user who uses the Teams desktop or web browser version.

Since the lockdown was introduced remote traffic is increased, and attackers taking advantage of the situation to steal corporate resources. Stay Safe Online!!

You can follow us on Linkedin, Twitter, and Facebook for daily Cybersecurity and hacking news updates.

Also, Read

Malicious App in Google Play Store Hijack SMS Message Notifications to Commit Billing Fraud

New Android Malware that Uses Chrome to Load Malicious Websites through Notifications

Fake cryptocurrency Wallets Apps on Google Play Steal User Credentials and Mimic Legitimate Wallets