{
  "timestamp": "2025-02-05T22:14:49.800718",
  "content": "Search Free Trial Get Demo Office 365 Phishing Email Campaign Hides Excel Template in HTML March 18, 2021 Phishing remains one of the most popular types of corporate attacks in terms of its prevalence, and therefore it is not surprising that attackers are coming up with increasingly sophisticated methods to obtain the victims personal data. Signs of an Office 365 Phishing Attack A Warning from Microsoft The warning usually states that you should call Windows support now at XXX-XXX-XXXX, creating a sense of urgency, however it will rarely say Microsoft Support. This warning might come up as partial or full screen, but will be hard to close the window. Clicking the close button usually wont allow you to exit from the popup. Youll have to end the task through task manager in order to close the alert box. A Prerecorded Audio You may also hear a pre-recorded audio that announces the alert. These types of warnings have been reported on legitimate websites. While they are usually harmless, you will want to make sure you do not follow the instructions on the alert. Warning Messages Your pop-up blocker will not be able to block these kinds of alerts. Its best to try clearing your browser history once you encounter a message like this and then follow that up with an in-depth virus scan. Using Tried and True Methods The best defense is educating your employees, filtering email  making sure everyone uses multi-factor authentication. A Recent Office 365 Phishing Email Attack Example One of the most recent phishing attacks detected by Cyren Inbox Security was trying to gain the personal passwords of the emails recipients through the attached HTML page that appeared to be an Excel file titled Microsoft Office Center. Employees of several organizations using Cyren Inbox Security solution started to receive emails sent from the automatically generated email addresses all hosted on the compromised server5.fngnetde-dns.com sender domain. The senders display name mirrored the targeted organization Company Invoic\u00e9 Repo\u0155t and the subject prompted Invoi\u0107e IDXXXXXX is ready for payme\u0144t . Phishers cleverly used the special characters in the subject and display name \u00e9, \u0144 in order to minimize the chances of the automatic email spam filtering by the Invoice and payment keywords. Email body was empty, but the email contained an HTML attachment passing for the xlsx file of an invoice mentioning the specific targeted company in its name, increasing the chances of the recipient to open the file. Once opened, the fake login page titled Microsoft Office Center on the Excel background appeared aiming to steal the users password. Visually, this attack looks identical to the one mentioned in the recent article by Bleeping Computers , where Morse code is used in the HTML attachment code to hide a phishing URL. But in this case, instead of the Morse code in the HTML attachment, the obfuscated Javascript code is used which makes it harder to unveil its true purpose until it is executed. The script contained a separate function personalizing the visuals of the phishing campaign The ml variable was responsible for the recipients email address, and the var logi added the targeted brand logo image onto the phishing page. The images were taken from the logo.clearbit.com  a legitimate Logo API tool from Clearbit in which hundreds of company logos are freely available. This script not only makes the attack personalized but also significantly expands the potential number of affected companies by the attacker changing the logo variable only. The password field on the HTML attachment is responsible for stealing personal information. This is executed in a PHP form with method post and action URL that would send all the inserted credentials and password information to the attacker The action URL is exploiting the legitimate Japanese site for its hostile purposes enctypemultipartform-data which indicates that all the submitted login and password information would have been divided into multiple parts and sent to the phishing server. Cyren Inbox Security Detection With Cyren Incident Response and its 247 support for phishing investigation, the attack was rapidly investigated and all the emails related to the attack were appropriately classified as phishing for all the targeted Cyren Inbox Security c ustomers. Discover a behind the scenes look at phishing kits. Watch the Webinar Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Loose SPF, DKIM, DMARC, and ARC Settings Sabotage Security A Dridex Phishing Campaign Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443",
  "analysis_type": "comprehensive",
  "analysis": "**Comprehensive Analysis of Office 365 Phishing Attack Content**\n\nThe content describes a sophisticated Office 365 phishing attack detected by Cyren Inbox Security, highlighting the attack's methodology and the solution's response. Below is the analysis structured into key categories:\n\n### 1. Key Security Features and Their Benefits\n- **Cyren Inbox Security Detection**: This feature swiftly identifies and classifies phishing emails, protecting users from malicious content.\n- **Multi-Factor Authentication (MFA)**: Enhances account security by requiring multiple verification steps, making unauthorized access harder.\n- **Advanced Email Filtering**: Blocks phishing attempts by analyzing email content and sender details, reducing the risk of malicious emails reaching users.\n\n### 2. Compliance Certifications and Regulatory Adherence\n- **Implicit Compliance**: While the content doesn't explicitly mention certifications like ISO 27001 or GDPR, the detection mechanisms align with industry standards for data protection.\n\n### 3. User-Focused Security Recommendations\n- **Education and Awareness**: Regular training helps employees recognize phishing tactics, such as urgent messages or suspicious attachments.\n- **Verify Senders**: Check the sender's email address and look for personalized details to avoid falling for spoofed emails.\n- **Avoid Suspicious Links/Attachments**: Refrain from opening unexpected attachments or clicking links from untrusted sources.\n\n### 4. Technical Security Implementation Details\n- **HTML Attachment with Obfuscated JavaScript**: Attackers use legitimate services and encoding to hide malicious intent, making detection challenging.\n- **Personalization Techniques**: Dynamic content like company logos and emails are used to increase the attack's success rate.\n- **Cyren's Detection Mechanisms**: Utilize advanced algorithms and incident response to block threats effectively.\n\n### 5. Data Protection Measures\n- **Secure Data Handling**: Emphasize encryption and secure transmission (e.g., HTTPS) to protect sensitive information.\n- **Regular Security Audits**: Ensure systems are updated and patched to prevent exploitation of vulnerabilities.\n\n### 6. Best Practices for End Users\n- **Vigilance**: Always be cautious with unexpected emails and attachments.\n- **Use MFA**: Enable MFA to add an extra layer of security.\n- **Antivirus Software**: Install reputable software and keep it updated.\n- **Incident Response Plan**: Establish a plan for quick response to potential breaches.\n\n### Summary\nThe analysis highlights the effectiveness of Cyren Inbox Security in detecting and mitigating phishing attacks. It underscores the importance of combining advanced security solutions with user education and best practices to enhance overall security. Organizations should consider encryption, regular audits, and incident response plans to further protect against threats."
}