{
  "timestamp": "2025-02-05T19:58:05.926890",
  "content": "Search Free Trial Get Demo Anatomy of an Attack Evasive Zoom phishing campaign using multiple phishing techniques at once December 14, 2020 Anatomy of an Attack Evasive Zoom phishing campaign using multiple phishing techniques at once In the final days of November, Cyren Inbox Security detected a massive phishing attack with a fake Microsoft 365 login page. Interestingly, they used many techniques to make the attack more evasive. Related Microsoft reports a leap in attack sophistication The Attack On Thursday, November 26, at 0951 UTC, an immense phishing campaign started targeting more than two thirds of the organizations using Cyren Inbox Security at once. It became one of the biggest malicious attacks in November by the number of phishing emails totally distributed. The emails were sent as if from a Zoom account ,while spoofing the target organizations domain as a sender domain. This made the email look trustworthy, as if it was sent internally inside the enterprise. But once checking the authentication results, the sender mail address was spoofed dkimfail no key for signature dmarcfail failure in both SPF and DKIM compauthfail reason601 marked by Office365 ATP as spoofed. Attackers used the SendGrid infrastructure for emails to reach the maximum number of victims mailboxes sender IP is 168.245.36.62, which is a SendGrid mail server. The email itself contained a message urging the recipient to Review a video conferencing invitation. In order to review invitation the target would click on the phishing URL hxxpsemail.utest.comlsclick?upn under the button. This query opened a fake Microsoft 365 login page hosted on an appspot.comdomain. Example of the phishing landing page hxxpscebxbhilakscgyzdcjdilniduq-dot-chrome-backbone-296016.uc.r. appspot.com ?utm_campaignwebsiteutm_sourcesendgrid.comutm_mediumemail The phishing was distributed by abusing a high-Alexa uTest domain , which redirected to the URL with auto-generated subdomains hosted on another high-Alexa domain appspot.com. Each URL contained sendgrid.com as a UTM source, which attackers could misuse to visualize and measure the impact of the sent emails on the potential victim. This phishing attack combined several techniques abusing the high-Alexa popular domains utest.com and appspot.com leveraging SendGrid infrastructure spoofing the target enterprises domain as mail sender, which made it easier for the phishing emails to by-pass the existing security email filtering capabilities. Cyren Inbox Security Detection With Cyren Incident Response Service and its 247 support for phishing investigation, the attack was rapidly investigated and all the emails related to the attack were appropriately classified as phishing for all the Cyren Inbox Security customers. Learn more about Cyren Inbox Security  Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Phishing hosted on high Alexa domains another dangerous trick in Web Anatomy of a Malware Attack Emails with Password-Protected Files Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443",
  "analysis_type": "product",
  "analysis": "**Analysis of Cyren Inbox Security Features:**\n\n1. **Key Security Features:**\n   - **Advanced Threat Detection:** Cyren's Inbox Security detected a large-scale phishing campaign using multiple evasion techniques, including domain spoofing and high-Alexa domain abuse.\n   - **Email Authentication Monitoring:** The product identifies failures in DKIM, SPF, and DMARC, which are critical for preventing email spoofing.\n   - **Incident Response Service:** Offers 24/7 support, enabling rapid investigation and classification of phishing emails, enhancing response time and effectiveness.\n\n2. **User Benefits and Protection Measures:**\n   - **Proactive Threat Prevention:** Blocks phishing emails before they reach users, reducing the risk of data breaches.\n   - **Continuous Monitoring:** Provides real-time detection and response, ensuring timely alerts and actions against threats.\n   - **Rapid Classification:** Quickly classifies emails as phishing, protecting a vast number of users from potential attacks.\n\n3. **Integration with Existing Security Systems:**\n   - **Compatibility:** Likely integrates with major email systems (e.g., Office 365) through APIs or gateways, enhancing overall security infrastructure.\n   - **Seamless Operation:** Works alongside existing email security solutions, improving threat detection without disrupting user workflow.\n\n4. **Compliance and Certification:**\n   - **Adherence to Standards:** Complies with email security protocols like DMARC, SPF, and DKIM, ensuring robust protection against spoofing.\n   - **Potential Certifications:** While not detailed, such products often hold certifications like ISO 27001, underscoring their commitment to security and data protection.\n\n5. **Security Best Practices for Users:**\n   - **Vigilance:** Users should be cautious of emails with urgent requests and verify senders before taking action.\n   - **Avoid Suspicious Links:** Refrain from clicking on links from unknown sources and hover over links to check URLs.\n   - **Multi-Factor Authentication (MFA):** Enable MFA to add an extra layer of security for account access.\n\n6. **Technical Specifications and Requirements:**\n   - **Scalability:** Capable of handling large volumes of emails, ensuring quick processing even during extensive attacks.\n   - **Compatibility:** Works with various email platforms, ensuring broad applicability and flexibility in deployment.\n   - **Performance:** Designed for high-speed processing to maintain user experience while enhancing security.\n\nThis structured analysis highlights Cyren Inbox Security's robust features and benefits, emphasizing its role in protecting users from sophisticated threats while integrating smoothly with existing systems."
}