Office 365 Phishing Campaign Enables Unique Evasion Methods

Summary

An active Office 365 credential phishing campaign was observed using several evasion methods in an attempt to bypass sandbox environments. The campaign targets enterprises with lures relevant to teleworkers, such as password updates, video teleconferencing (VTC) invitations, and helpdesk tickets. One of the evasion tactics employed is the use of redirector URLs, in which automated analysis attempts will be redirected to legitimate sites rather than the phishing landing page. Additionally, custom subdomains are generated to use with redirector sites for each of the targets and often contain the target's username and their organization's domain name in order to appear legitimate.

Recommendations

The NJCCIC reminds users to avoid clicking on links and attachments received from unknown contacts, and exercise caution with those from known contacts. If you are unsure of an email’s legitimacy, contact the sender via a separate means of communication before taking action. Additional information can be found in the Bleeping Computer article.