Phishing campaign via SharePoint file shares
A new phishing technique recently observed would allow malicious actors to recover their email login information.
Description
Technical context and vulnerability details
Legitimate SharePoint sharing links are used to trick users into redirecting them to a fake authentication site and collecting their login credentials. The phishing attempt begins by receiving a SharePoint sharing link inviting the user to view a file. By accessing this link, the user is asked to enter their email address and then enter an OTP code received in their mailbox, thus reinforcing the credibility of the process. Once access to the file is gained, it contains a second link redirecting to a fake Microsoft login page, where the user is prompted to enter their Microsoft login password, which is retrieved by the malicious actors. After entering a valid password, the user is automatically redirected to the Twitter site. Malicious actors thus obtain the user's login credentials and can access their mailbox, and thus carry out other malicious activities.
Potential Risks & Impact
Potential consequences upon exploitation
- Data privacy breach;
- Data integrity breach;
- Theft of sensitive information;
Affected systems
Products, components and targeted versions
- Systems and software components affected by Phishing campaign via SharePoint file shares;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Check the sender of an email before taking action;
- Avoid clicking on suspicious links in received emails;
- Systematically check the URLs of login pages before entering login credentials;
- Block URLs and domains associated with this phishing campaign;
- Implement double authentication whenever possible for access to the email account;
INDICATORS OF COMPROMISE:
- alrci[.]mspfzcorel[.]name
- hxxps[://]mspfzcorel[.]name?HeLlrAog&sa=D&sntz=1&usg=AOvVaw1dSgeQPOQoukXBg6pZwdkQ#?1187507008Family=
- nrqmhd[.]mspfzcorel[.]name
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.