{
  "content": "Search Free Trial Get Demo Anatomy of an Attack Evasive Zoom phishing campaign using multiple phishing techniques at once December 14, 2020 Anatomy of an Attack Evasive Zoom phishing campaign using multiple phishing techniques at once In the final days of November, Cyren Inbox Security detected a massive phishing attack with a fake Microsoft 365 login page. Interestingly, they used many techniques to make the attack more evasive. Related Microsoft reports a leap in attack sophistication The Attack On Thursday, November 26, at 0951 UTC, an immense phishing campaign started targeting more than two thirds of the organizations using Cyren Inbox Security at once. It became one of the biggest malicious attacks in November by the number of phishing emails totally distributed. The emails were sent as if from a Zoom account ,while spoofing the target organizations domain as a sender domain. This made the email look trustworthy, as if it was sent internally inside the enterprise. But once checking the authentication results, the sender mail address was spoofed dkimfail no key for signature dmarcfail failure in both SPF and DKIM compauthfail reason601 marked by Office365 ATP as spoofed. Attackers used the SendGrid infrastructure for emails to reach the maximum number of victims mailboxes sender IP is 168.245.36.62, which is a SendGrid mail server. The email itself contained a message urging the recipient to Review a video conferencing invitation. In order to review invitation the target would click on the phishing URL hxxpsemail.utest.comlsclick?upn under the button. This query opened a fake Microsoft 365 login page hosted on an appspot.comdomain. Example of the phishing landing page hxxpscebxbhilakscgyzdcjdilniduq-dot-chrome-backbone-296016.uc.r. appspot.com ?utm_campaignwebsiteutm_sourcesendgrid.comutm_mediumemail The phishing was distributed by abusing a high-Alexa uTest domain , which redirected to the URL with auto-generated subdomains hosted on another high-Alexa domain appspot.com. Each URL contained sendgrid.com as a UTM source, which attackers could misuse to visualize and measure the impact of the sent emails on the potential victim. This phishing attack combined several techniques abusing the high-Alexa popular domains utest.com and appspot.com leveraging SendGrid infrastructure spoofing the target enterprises domain as mail sender, which made it easier for the phishing emails to by-pass the existing security email filtering capabilities. Cyren Inbox Security Detection With Cyren Incident Response Service and its 247 support for phishing investigation, the attack was rapidly investigated and all the emails related to the attack were appropriately classified as phishing for all the Cyren Inbox Security customers. Learn more about Cyren Inbox Security  Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Phishing hosted on high Alexa domains another dangerous trick in Web Anatomy of a Malware Attack Emails with Password-Protected Files Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443",
  "analysis_results": {
    "metadata": {
      "timestamp": "2025-02-05T22:16:05.169560",
      "model": "deepseek/deepseek-r1-distill-llama-70b",
      "categories": [
        "product_security_features",
        "threat_prevention",
        "incident_response"
      ],
      "content_length": 3143,
      "analyses_included": {
        "product_analysis": true,
        "user_guidance": false
      }
    },
    "analyses": {
      "comprehensive": "### Analysis of the Phishing Campaign and Security Measures\n\n**1. Key Security Features and Their Benefits:**\n- **Cyren Inbox Security:** AI-driven detection mechanisms that quickly identify phishing attempts, preventing potential breaches and minimizing damage.\n- **24/7 Incident Response Service:** Enables rapid investigation and containment of attacks, ensuring timely mitigation.\n\n**2. Compliance Certifications and Regulatory Adherence:**\n- While specific certifications are not detailed, the effective use of email authentication protocols (SPF, DKIM, DMARC) suggests adherence to email security standards.\n- Compliance with regulations like GDPR is implied through prompt attack detection and user protection measures.\n\n**3. User-Focused Security Recommendations:**\n- **Caution with Emails:** Verify sender domains and be wary of urgent requests.\n- **Avoid Clicking Suspicious Links:** Hover over links to check URLs before clicking.\n- **Report Phishing:** Alert IT or security teams upon encountering suspicious emails.\n- **Multi-Factor Authentication (MFA):** Enhance account security to prevent unauthorized access.\n- **Software Updates:** Regularly update software to protect against vulnerabilities.\n\n**4. Technical Security Implementation Details:**\n- **Spoofing Techniques:** Attackers used domain spoofing and legitimate services (SendGrid, appspot.com) to bypass filters.\n- **High-Alexa Domains and Redirection:** Utilized reputable domains and UTM parameters for tracking.\n- **Detection Methods:** Cyren likely employs header analysis, URL checking, and content inspection to identify threats.\n\n**5. Data Protection Measures:**\n- **Credential Protection:** Shield Microsoft 365 credentials to prevent data breaches.\n- **Monitoring:** Regularly check for unauthorized access and implement encryption for sensitive data.\n\n**6. Best Practices for End Users:**\n- **Employee Training:** Educate on recognizing phishing attempts.\n- **Email Traffic Monitoring:** Use tools to detect and block malicious content.\n- **Security Tool Implementation:** Deploy solutions for email authentication and threat detection.\n- **Incident Response Plan:** Establish procedures for quick response and mitigation.\n\nThis analysis highlights the importance of multi-layered security approaches and user vigilance in combating sophisticated phishing campaigns.",
      "product": "**Explaining Cyren Inbox Security Features and Protection**\n\n**1. Key Security Features:**\n   - **Advanced Threat Detection:** Cyren Inbox Security uses real-time URL analysis and domain reputation checks to identify and block phishing attempts, even those using legitimate services like SendGrid.\n   - **Email Authentication Protocols:** Employs DMARC, SPF, and DKIM to verify sender authenticity, flagging emails that fail these checks as suspicious.\n   - **Incident Response Service:** Offers 24/7 expert support to quickly investigate and mitigate threats, ensuring minimal impact.\n\n**2. User Benefits:**\n   - **Proactive Protection:** Acts as an additional layer of defense, stopping phishing emails before they reach the user.\n   - **Seamless Integration:** Enhances existing email security without disrupting current systems, integrating with platforms like Office 365.\n   - **Peace of Mind:** With continuous monitoring, users are protected around the clock, reducing the risk of successful attacks.\n\n**3. Integration Capabilities:**\n   - Designed to work alongside existing email services, enhancing their security features without complicating the setup.\n\n**4. Compliance and Data Protection:**\n   - Complies with regulations like GDPR and CCPA, ensuring data handling meets legal standards and protecting user information.\n\n**5. Security Best Practices:**\n   - Encourages user caution with links and verifying senders, though the automated features reduce the need for extensive user expertise.\n\n**6. Technical Specifications:**\n   - Cloud-based deployment for scalability and ease of use.\n   - Compatible with various email platforms, ensuring broad applicability.\n\nIn summary, Cyren Inbox Security provides an extra layer of defense against sophisticated phishing attacks, integrating smoothly with existing systems and offering round-the-clock protection. Users benefit from advanced threat detection and rapid response, ensuring their security without needing to be technical experts.",
      "user_guidance": null
    }
  },
  "metadata": {
    "timestamp": "2025-02-05T22:16:05.169560",
    "model": "deepseek/deepseek-r1-distill-llama-70b",
    "categories": [
      "product_security_features",
      "threat_prevention",
      "incident_response"
    ],
    "content_length": 3143,
    "analyses_included": {
      "product_analysis": true,
      "user_guidance": false
    }
  }
}