Criminals use fake Microsoft Teams alerts to gain Office 365 access
Remote workers are being urged to take extra care following the reveal of a new security scam affecting Microsoft Teams.
Users of the popular video conferencing service are being targeted by a phishing scam that looks to trick Teams customers into handing over their logins.
Criminals have designed fake email alerts that spoof Microsoft Teams file share and audio chat notifications, with as many as 50,000 emails already detected.
This tactic is particularly dangerous as users are being bombarded with more alerts than ever as the popularity of video conferencing tools such as Microsoft Teams increases, this makes victims more likely to click on what they believe to be a legitimate message.
“Since the imagery found throughout this attack is actual imagery used by the legitimate provider, the recipient may be more convinced this is a legitimate email,” the researchers told BleepingComputer. “This holds especially true on mobile where images take up most of the content on the screen.”
The phishing campaign adds an extra level of sophistication thanks to the use of several URL redirects to hide the hosting addresses and avoid email protection services.
If the victim clicks on a link in the malicious email, they are then taken to a fake landing page which accurately copies the real Office 365 login page, however, entering account details there will lead to the information being stolen.
Microsoft Teams is one of several video conferencing and collaboration tools that have seen a huge spike in user numbers in recent weeks due to the global coronavirus lockdown.
Last week, Microsoft CEO Satya Nadella revealed Teams has surpassed 75 million daily active users.
Moore, Mike. “Look out – That Microsoft Teams Alert Might be a Phishing Scam” Techradar.com May 4, 2020
______________________________________________________________________________________
No one wants to become a victim of a social engineering attack, so it’s important to recognize an attack in progress and not be tricked into responding to it inappropriately.
Trained and aware employees are critical to securing an organization, and an effective, ongoing internal security awareness program can help reduce your company’s vulnerability, turning the “weakest link” in your cyber defenses into its greatest strength.
One of our most important roles as a technology service provider is to protect the assets of our clients. No matter how big or small your business is, a single compromised credential could put your entire business at risk. Give us a call to further discuss how we can help in protecting your business against cybersecurity threats and how we can make technology work for your business.
Call us now at 732.780.8615 or email us at [email protected]