Microsoft finds active phishing campaign exploiting service disruption
Detailed summary
It said that similar messages targeted organisations across multiple US sectors, adding that activity is consistent with credential phishing ...
Microsoft Threat Intelligence on Saturday found that an active phishing campaign was exploiting the Microsoft 365 service disruption on November 12.
The messages, it said, impersonate notifications from Microsoft, referencing legitimate Exchange Online incident EX1550543. "Some of the phishing emails Microsoft detected on November 13 falsely claim that messages were held during the outage and will be deleted within 24 hours unless recipients click to restore them."
It said that observed subjects follow the pattern "Outage - [six-character code]," with sender display names using organisation-specific prefixes followed by "Outage Notification" or "Service Health."
The campaign uses three sender domains, moments-notice[.]com, planetmaison[.]com, and newbooker[.]com, with recipient-specific SendGrid click-tracking links redirecting to reallifeaccounting[.]com, including the observed path /themelist0.html.
It said that similar messages targeted organisations across multiple US sectors, adding that activity is consistent with credential phishing. It also said that credential collection and malware delivery have not been confirmed.
"Security teams can use Microsoft Defender for Office 365 Threat Explorer and Microsoft Defender XDR advanced hunting (EmailEvents, EmailUrlInfo, and UrlClickEvents) to identify suspicious messages, examine embedded URLs, and investigate user clicks."
Meher Dhanjal is a Digital Journalist who breaks news first and breathes second. She loves chasing page views and finding stories that tug at readers’ heartstrings.
Gold drops 3% to over one-year low as fading Middle East peace hopes fan inflation fears
From SpaceX to Anthropic, markets have a new playbook for mega-share debuts
Opening of the article, excerpted from Khaleej Times. To read the rest, open the article on the publisher's site.
MarketNews shows the headline and summary published by the outlet. The full article is on the publisher's website. (www.khaleejtimes.com)
