Microsoft Office 365 Credentials Under Attack By Fax ‘Alert’ Emails

[silversurfer]

Researchers are warning of a coordinated phishing attack that targeted “numerous” enterprise organizations last week.
 
The attackers behind the attack leveraged hundreds of compromised, legitimate email accounts in order to target organizations with emails, which pretended to be document delivery notifications. In reality, the phishing attack stole victims’ Office 365 credentials.
 
“The widespread use of hundreds of compromised accounts and never-seen-before URLs indicate the campaign is designed to bypass traditional threat intelligence solutions accustomed to permitting known but compromised accounts into the inbox,” said researchers with Abnormal Security, in a Monday analysis.
 
The attack starts with a lure convincing email recipients that they received a document. The email impersonates businesses like eFax, which is an internet fax service making it easy to receive faxes via email or online.

Read more: https://threatpost.com/microsoft-office-...ax/162232/