Phishers hack SharePoint sites to steal login information of people performing banking transactions

OneNote documents and SharePoint websites are being compromised to carry out one novel large-scale phishing campaign. SharePoint, a service to synchronize cloud-based files and also to store them is a creation of Microsoft. Cofense security investigators have warned of cyber-criminals seeking towards victimizing people performing banking operations to make them land on imposter web-pages so their login details can be captured.

The phishing attack involves fraudulent e-mails that are dispatched from hijacked A/Cs directing the recipients for perusing one legitimate proposal from assessors by visiting a given URL.

But when the recipient does as directed he lands on one hijacked SharePoint website set up utilizing a compromised A/C and also which is under the control of cyber-criminals. The said website contains one phony OneNote document that can't be read, so the victims are directed for taking down the complete edition by visiting the given web-link.

The process then diverts victims onto the spoofed website that harbors one imposter login page for 'OneDrive for Business,' while a message appears on top beyond the margin of login questionnaire stating about the document as being safe so user can login for reading, editing else downloading. For continuing further users require choosing a given option. Unfortunately, when the login details are typed in, either using some other e-mail provider else an Office 365 A/C, the user's e-mail information actually goes into the hold of hackers. www.itproportal.com posted this dated September 5, 2019.

A reason given for the cyber-criminals choosing Microsoft's SharePoint service for executing their phishing assaults is the domains that have been utilized very often evades the notice of protected e-mail gateways so the mechanism lets the phishing e-mails to indeed land into the victims' inboxes.

According to security awareness advocate Javvad Malik from KnowBe4, using cloud-based services as also SharePoint platforms for harboring fake contents and also bypassing security controls is on an increase. With the continuous evolution of phishing techniques for bypassing technical defenses, it's now extremely important that employees within organizations are trained for recognizing phishing e-mails, which when do evade filters, however may get rejected at the recipients' end.

» SPAMfighter News - 9/12/2019