A Microsoft Teams Phishing Email #Scam Is Making The Rounds
Happy new year! And three days into the new year I have my first phishing scam that you need to be aware of. This one is the first that I have personally seen that leverages Microsoft Teams and starts with an email:
So let’s unpack this. If you look at the reply to address, it’s from a domain registered in Switzerland which is a bit different. That may be to gain your confidence if you’re paying attention to that sort of thing, which you should be. Or it could be a “throwaway domain” which the scammer is using. As from who it is sent from:
Well, that’s a bit suspect. Since this doesn’t match the reply to address, this is clearly a scam. But let’s see how far this goes.
If you click on the words “View / Download Sent File From Email Attachment”, which by the way you should never, ever do, you get this:
Well, someone spent a lot of time and effort putting this together as it looks like Microsoft would created. I also note that this web page has your email address automatically added and all you have to do is type in your password. That’s because the link that I referred to earlier has your email address embedded in it and there’s no way to change it on the web page. Thus this implies that this could be a targeted phishing attack called “spear phishing”. But what is clear is that the attack is to get your Office 365 credentials at the very least. There’s likely more to it than that. But I can’t tell you what that “more” is as when I typed in various bogus passwords, I get this error message:
Now it could be that it has captured your Office 365 credentials and someone is going to try them right away to pwn your Office 365 account, or it could be doing something more sophisticated. For example I can see a scenario where these are checked against Office 365 in real time. I’m thinking that it’s more likely the former. But given how phishing attacks have evolved over the last year, anything is possible.
As usual, my advice is that if you get one of these emails, delete it. Don’t click on anything. Just delete it and move on with your life.
This entry was posted on January 3, 2023 at 12:04 pm and is filed under Commentary with tags Scam. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
A Microsoft Teams Phishing Email #Scam Is Making The Rounds
Happy new year! And three days into the new year I have my first phishing scam that you need to be aware of. This one is the first that I have personally seen that leverages Microsoft Teams and starts with an email:
So let’s unpack this. If you look at the reply to address, it’s from a domain registered in Switzerland which is a bit different. That may be to gain your confidence if you’re paying attention to that sort of thing, which you should be. Or it could be a “throwaway domain” which the scammer is using. As from who it is sent from:
Well, that’s a bit suspect. Since this doesn’t match the reply to address, this is clearly a scam. But let’s see how far this goes.
If you click on the words “View / Download Sent File From Email Attachment”, which by the way you should never, ever do, you get this:
Well, someone spent a lot of time and effort putting this together as it looks like Microsoft would created. I also note that this web page has your email address automatically added and all you have to do is type in your password. That’s because the link that I referred to earlier has your email address embedded in it and there’s no way to change it on the web page. Thus this implies that this could be a targeted phishing attack called “spear phishing”. But what is clear is that the attack is to get your Office 365 credentials at the very least. There’s likely more to it than that. But I can’t tell you what that “more” is as when I typed in various bogus passwords, I get this error message:
Now it could be that it has captured your Office 365 credentials and someone is going to try them right away to pwn your Office 365 account, or it could be doing something more sophisticated. For example I can see a scenario where these are checked against Office 365 in real time. I’m thinking that it’s more likely the former. But given how phishing attacks have evolved over the last year, anything is possible.
As usual, my advice is that if you get one of these emails, delete it. Don’t click on anything. Just delete it and move on with your life.
Share this:
Like this:
Related
This entry was posted on January 3, 2023 at 12:04 pm and is filed under Commentary with tags Scam. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.