Modern-day phishing methods include abusing legitimate cloud services to bypass email security solutions and land a malicious email right into the victim’s inbox.
In this latest example, cybersecurity researchers from Trustwave found a threat actor abusing Microsoft’s Rights Management Services (RMS) to deliver links to fake landing pages to their victims. The attacks are highly targeted and quite difficult to mitigate, the researchers are saying.
In the attack, the threat actors will use a previously stolen email account to send a message to their victim. The message will contain an attachment created using the RSM service, meaning it will be encrypted and will carry the .RPMSG extension. Microsoft designed RSM to offer an additional layer of protection for sensitive files, by forcing readers to first authenticate.
Stealing sensitive data
The authentication can be done either using the Microsoft account, or via a one-time passcode.
Once the users authenticate and be granted the ability to read the message, they’ll be redirected to a fake SharePoint document hosted on Adobe’s InDesign service. The document holds a “Click Here to View Document” call-to-action, which brings the users to an empty page with a “Loading” message. This is merely a distraction, while a malicious script siphons sensitive data in the background.
The data includes visitor ID, connect token and hash, video card renderer information, system language, device memory, hardware concurrency, installed browser plugins, browser window details, and OS architecture. Once this process is complete, the page will reload into a fake Microsoft 365 login form that steals the visitor’s login credentials and sends them to the attackers.
“Educate your users on the nature of the threat, and not to attempt to decrypt or unlock unexpected messages from outside sources,” Trustwave said in its report.
“To help prevent Microsoft 365 accounts being compromised, enable Multi-Factor Authentication (MFA).”
Multi-factor authentication is not foolproof but does make the threat actors work a lot harder to gain access to their target’s endpoints. Given that it’s quite simple to set up, MFA is praised in the cybersecurity community and is considered the industry standard.
Via: BleepingComputer
