Attackers are abusing Microsoft Teams to send phishing messages, according to researchers at AT&T Cybersecurity. “While most end users are well-acquainted with the dangers of traditional phishing attacks, such as those delivered via email or other media, a large proportion are likely unaware that Microsoft Teams chats could be a phishing vector,” the researchers write. “Most Teams activity is intra-organizational, but Microsoft enables External Access by default, which allows members of one organization to add users outside the organization to their Teams chats.[1] Perhaps predictably, this feature has provided malicious actors a new avenue by which to exploit untrained or unaware users.”
In the case observed by AT&T Cybersecurity, the attackers used a compromised domain to send the messages. “An important detail to note here is the “.onmicrosoft[.]com” domain name,” the researchers write. “This domain, by all appearances, is authentic and most users would probably assume that it is legitimate. OSINT research on the domain also shows no reports for suspicious activity, leading the MDR SOC team to believe the username (and possibly the entire domain) was likely compromised by the attackers prior to being used to launch the phishing attack.”
In this case, the attackers sent users a malicious file with a double extension designed to trick users into thinking it’s a PDF file. This file, when opened, would install the DarkGate malware. “The MDR SOC team continued to drill down on the phished users to determine the precise nature of the attack,” the researchers explain. “They subsequently discovered three users who had downloaded a suspicious double extension file. The file was titled ‘Navigating Future Changes October 2023.pdf.msi.’ Double extension files are commonly used by attackers to trick users into downloading malicious executables, as the second extension, .msi in this case, is usually hidden by the filesystem. The user believes they are downloading a PDF for business use, but instead receives a malicious installer.”
AT&T Cybersecurity has the full story.
This article is presented at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. Call for assistance. For questions, comments, a demo or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
Reporting: https://www.redskyalliance.org/
Website: https://www.redskyalliance.com/
LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/5993554863383553632
[1] https://blog.knowbe4.com/microsoft-teams-phishing-attacks
Comments