Friday, May 24, 2024

Microsoft Two-Step Phishing Campaign Attack LinkedIn Users

The professional and personal online spheres are merging as social media platforms like Facebook, LinkedIn, and WhatsApp are now commonly used for work communication. Their integration creates cybersecurity vulnerabilities. 

Threat actors can target employees on social media using their accounts accessed from work devices.

These accounts act as attack vectors, allowing unauthorized access to the organization’s systems. 

A new LinkedIn threat combines breached users’ accounts and an evasive 2-step phishing attack.

A recent Python-based infostealer called Snake targets Facebook users with malicious messages.

By tricking users into downloading malware, Snake steals sensitive browsing data to hijack accounts. 

It highlights how social media is a potential attack vector for stealing credentials and compromising corporate systems. 

“Sales Proposal” Office Word document hosted on
“Sales Proposal” Office Word document hosted on

LinkedIn is a social media platform for professional networking that is vulnerable to attacks due to the abundance of publicly available user data. 

Attackers can harvest email addresses for surveys and use fake profiles to deliver malware through phishing attacks. Perception Point recently discovered a new attack that combines compromised user accounts with a 2-step phishing scheme to bypass detection. 

Run Free Threat Scan on Your Mailbox to Stop Phishing

Protect Your Business Emails with AI-Powered Security

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Try Trustifi Free Threat Scan with Sophisticated AI-Powered Email Protection .

Compromised LinkedIn accounts had been exploited to launch social engineering attacks. The attackers sent messages to the victim’s network, pretending to be a trusted connection (1st degree). 

An example of a deceptive message from a compromised account
An example of a deceptive message from a compromised account

The messages contain a malicious link disguised as a legitimate OneDrive document link, often using the lure of a confidential project to trick the victim into clicking it, leading to an account takeover. 

Attackers use a hidden JavaScript payload that shows fake protection DDoS display screen
Attackers use a hidden JavaScript payload that shows fake protection DDoS display screen

Phishing actors utilize a two-step attack. First, they trick victims into clicking a URL that leads to a legitimate OneDrive page hosting a malicious Word document. 

Free Webinarfor DIFR/SOC Teams: Securing the Top 3 SME Cyber Attack Vectors - Register for Free

Second, the document embeds a URL redirecting victims through a fake Cloudflare verification prompt before landing on a phishing webpage designed to steal Microsoft 365 credentials. 

3rr0r Hun73r – the threat actor behind the phishing website
3rr0r Hun73r – the threat actor behind the phishing website

The phishing page’s HTML code reveals it originates from a group called “3rr0r Hun73r” that creates and sells phishing kits. 

Social media’s popularity creates a vulnerability for enterprises where hackers exploit employees’ social media use within work browsers to steal personal and corporate data. 

Secure your emails in a heartbeat! Take our free 30-second assessment and get matched with your ideal email security vendor.


Latest articles

Hackers Weaponizing Microsoft Access Documents To Execute Malicious Program

In multiple aggressive phishing attempts, the financially motivated organization UAC-0006 heavily targeted Ukraine, utilizing...

Microsoft Warns Of Storm-0539’s Aggressive Gift Card Theft

Gift cards are attractive to hackers since they provide quick monetization for stolen data...

Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining...

NSA Releases Guidance On Zero Trust Maturity To Secure Application From Attackers

Zero Trust Maturity measures the extent to which an organization has adopted and implemented...

Chinese Hackers Stay Hidden On Military And Government Networks For Six Years

Hackers target military and government networks for varied reasons, primarily related to spying, which...

DNSBomb : A New DoS Attack That Exploits DNS Queries

A new practical and powerful Denial of service attack has been discovered that exploits...

Malicious PyPI & NPM Packages Attacking MacOS Users

Cybersecurity researchers have identified a series of malicious software packages targeting MacOS users.These...
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles