Share this article
Improve this guide
Fake Office 365 login page created to steal user credentials
2 min. read
Updated onOctober 4, 2023
updated onOctober 4, 2023
Share this article
Improve this guide
Read our disclosure page to find out how can you help Windows Report sustain the editorial teamRead more
Key notes
Cyber gangs, yet again, created a fakeOffice 365 loginpage with a view to stealing their victims’ Microsoft credentials, according to an AbnormalSecurityreport.
Threat actors have done this before, such as, when they set up afake Microsoft Outlook login pageto capture their targets’ Microsoft account usernames and passwords. They’ve also targeted remote workers that access their Office 365 accounts viaVPNs.
Fake Office 365 login page, spoofed Zoom email
In thephishing attackthat AbnormalSecurityreports, hackers targeted remote workers that that haveZoomand Office 365 accounts.
First, they spoof the official Zoom email address, from which they send phishing emails to their targets. But they’re targeting the employees’ Office 365 login credentials in the end.
Each phishing email notifies the recipient to click a provided link or lose access to their Zoom account.
As you’d expect with any such attack, clicking the link doesn’t lead to a legitimate Zoom site. Instead, it eventually takes the target to a fake Microsoft login page.
The phishing page is hosted on a different domain though. By attempting to log in to their Office 365 account via the fake portal, the victim hands their security credentials to the hackers.
The email contains a link concealed within the text that redirects to a page hosted on an unrelated domain (likely hijacked by the attackers). This link redirects to a fake Microsoft login page hosted on another domain. Though the email impersonates the Zoom brand, the attacker is targeting the recipient’s Microsoft credentials, which can be used to access a larger trove of sensitive information.
However, it’s not just the Office 365 platform that’s at risk. A recentsurveyby NetMotion found that 300 remote workers clicked malicious web links in just 30 days.
Against the backdrop of all these hacking and phishing events, it may be time to rethink best practices forcloud security.
What are your thoughts on possible Office 365 security gaps? Feel free to ask any question or leave a suggestion in the comments section below.
[wl_navigator]
More about the topics:Cybersecurity,Office 365
Don Sharpe
Tech Journalist
Don has been writing professionally for over 10 years now, but his passion for the written word started back in his elementary school days. His work has been published on Livebitcoinnews.com, Learnbonds.com, eHow, AskMen.com, Forexminute.com, The Writers Network and a host of other companies.
User forum
0 messages
Sort by:LatestOldestMost Votes
Comment*
Name*
Email*
Commenting as.Not you?
Save information for future comments
Comment
Δ
Don Sharpe
Tech Journalist
Don has been writing professionally for over 10 years now, simplifying the tech universe for the mases.
