Microsoft Office 365 Admins Targeted by Ongoing Phishing Campaign

[tarekma7]

A new phishing campaign is actively targeting Microsoft Office 365 administrators with the end goal of compromising their entire domain and using newly created accounts on the domain to deliver future phishing emails.

The attackers use phishing emails designed to look like they are coming from Microsoft, with the Office 365 logo shown at the top, and delivered using "validated domains" "from a legitimate organization’s Office 365 infrastructure" as PhishLabs found.

They also use "Services admin center" as the sender name for the phishing messages delivered through this ongoing campaign as an attempt to spoof the legitimate Microsoft 365 admin center support team, and "Action Required" or "We placed a hold on your account" subjects to persuade their targets to act first and think later.


With the help of this tactic, the threat actors take advantage of a common email filtering solution feature that uses the sender domain's reputation to decide if an email should be blocked or not.

"Well established domains with a track record of sending benign messages are less likely to be quickly blocked by these systems," PhishLabs says. "This increases the deliverability and efficiency of phishing lures."

Continue reading HERE