Fake Office 365 login page created to steal user credentials

by Don Sharpe
Don Sharpe
Don Sharpe
Don has been writing professionally for over 10 years now, but his passion for the written word started back in his elementary school days. His work has been... read more
Affiliate Disclosure
  • Cyber gangs created a fake Office 365 login page to steal their victims’ Microsoft credentials, according to an Abnormal Security report.
  • Remote workers that use Zoom were targeted in the phishing attack.
  • For tips and guides to optimizing security for your cloud-hosted IT systems, check out the Cloud Security section.
  • Go to the Security and Privacy hub to discover the best Windows security solutions. 
Zoom phishing attack

To fix various PC problems, we recommend DriverFix:
This software will keep your drivers up and running, thus keeping you safe from common computer errors and hardware failure. Check all your drivers now in 3 easy steps:

  1. Download DriverFix (verified download file).
  2. Click Start Scan to find all problematic drivers.
  3. Click Update Drivers to get new versions and avoid system malfunctionings.
  • DriverFix has been downloaded by 0 readers this month.

Cyber gangs, yet again, created a fake Office 365 login page with a view to stealing their victims’ Microsoft credentials, according to an Abnormal Security report.

Threat actors have done this before, such as, when they set up a fake Microsoft Outlook login page to capture their targets’ Microsoft account usernames and passwords. They’ve also targeted remote workers that access their Office 365 accounts via VPNs.

Fake Office 365 login page, spoofed Zoom email

In the phishing attack that Abnormal Security reports, hackers targeted remote workers that that have Zoom and Office 365 accounts.

First, they spoof the official Zoom email address, from which they send phishing emails to their targets. But they’re targeting the employees’ Office 365 login credentials in the end.

Each phishing email notifies the recipient to click a provided link or lose access to their Zoom account.

As you’d expect with any such attack, clicking the link doesn’t lead to a legitimate Zoom site. Instead, it eventually takes the target to a fake Microsoft login page.

The phishing page is hosted on a different domain though. By attempting to log in to their Office 365 account via the fake portal, the victim hands their security credentials to the hackers.

The email contains a link concealed within the text that redirects to a page hosted on an unrelated domain (likely hijacked by the attackers). This link redirects to a fake Microsoft login page hosted on another domain. Though the email impersonates the Zoom brand, the attacker is targeting the recipient’s Microsoft credentials, which can be used to access a larger trove of sensitive information.

However, it’s not just the Office 365 platform that’s at risk. A recent survey by NetMotion found that 300 remote workers clicked malicious web links in just 30 days.

Against the backdrop of all these hacking and phishing events, it may be time to rethink best practices for cloud security.

What are your thoughts on possible Office 365 security gaps? Feel free to ask any question or leave a suggestion in the comments section below.

idee restoro Still having issues? Fix them with this tool:
  1. Download this PC Repair Tool rated Great on TrustPilot.com (download starts on this page).
  2. Click Start Scan to find Windows issues that could be causing PC problems.
  3. Click Repair All to fix issues with Patented Technologies (Exclusive Discount for our readers).

Restoro has been downloaded by 0 readers this month.

This article covers:Topics: