Fake Office 365 login page created to steal user credentials

Cyber gangs, yet again, created a fake Office 365 login page with a view to stealing their victims’ Microsoft credentials, according to an Abnormal Security report.

Threat actors have done this before, such as, when they set up a fake Microsoft Outlook login page to capture their targets’ Microsoft account usernames and passwords. They’ve also targeted remote workers that access their Office 365 accounts via VPNs.

Fake Office 365 login page, spoofed Zoom email

In the phishing attack that Abnormal Security reports, hackers targeted remote workers that that have Zoom and Office 365 accounts.

First, they spoof the official Zoom email address, from which they send phishing emails to their targets. But they’re targeting the employees’ Office 365 login credentials in the end.

Each phishing email notifies the recipient to click a provided link or lose access to their Zoom account.

As you’d expect with any such attack, clicking the link doesn’t lead to a legitimate Zoom site. Instead, it eventually takes the target to a fake Microsoft login page.

The phishing page is hosted on a different domain though. By attempting to log in to their Office 365 account via the fake portal, the victim hands their security credentials to the hackers.

The email contains a link concealed within the text that redirects to a page hosted on an unrelated domain (likely hijacked by the attackers). This link redirects to a fake Microsoft login page hosted on another domain. Though the email impersonates the Zoom brand, the attacker is targeting the recipient’s Microsoft credentials, which can be used to access a larger trove of sensitive information.

However, it’s not just the Office 365 platform that’s at risk. A recent survey by NetMotion found that 300 remote workers clicked malicious web links in just 30 days.

Against the backdrop of all these hacking and phishing events, it may be time to rethink best practices for cloud security.

What are your thoughts on possible Office 365 security gaps? Feel free to ask any question or leave a suggestion in the comments section below.

[wl_navigator]