A recent hacking campaign impersonated notifications from Microsoft Teams and abused Microsoft’s legitimate authentication infrastructure to compromise corporate Outlook, SharePoint and OneDrive accounts.
In a blog post published on July 29 , cybersecurity researchers at Check Point warned that attackers are increasingly abandoning fake Microsoft login pages in favor of abusing Microsoft’s legitimate authentication infrastructure.
The campaign started in the final weekend of June and continued into July, targeting users at 120 organizations including manufacturing, legal and healthcare, with emails designed to look like a notification alert for Microsoft Teams from the company’s HR department.
Disguised as Microsoft Planner task-assignment notification, the sender’s name on the email was “There’s New Activity On Teams” and claimed HR had sent messages to the user on Microsoft Teams. The body of the message also referenced “overdue tasks” in an attempt to employ social engineering to pressure the user into interacting with the fake request.
If the user clicked a link in the message, they were taken to legitimate OAuth authorize URL.
If the user attempted to sign-in, the page provided them with a prompt to accept to “Approve permissions” or “Accept on behalf of your organization.” If the user did this, the login attempt was redirected to attacker-controlled infrastructure, and the attacker also received an authorization token.
With all of this done via their infrastructure, the attackers had the ability to access the account and could exploit this to do anything a legitimate user could do with their Microsoft 365 suite.
“Attackers have stopped forging Microsoft’s front door and started walking through it. Every screen the victim sees is authentic, the only fake thing in this entire chain is the intent behind the app requesting access,” Check Point said in the blog post.
With this access to the email account secured, researchers detailed that as well reading messages and exfiltrating data from the victim’s inbox, attackers could use this access to a legitimate, trusted account as a springboard for Business Email Compromise (BEC) attacks.
While this specific campaign is no longer active, Check Point noted that it is “yet another example of how attackers have fundamentally changed how they’re bypassing traditional phishing defenses.”
To help identify and protect against campaigns which use these techniques, Check Point recommended implementing the following advice:
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
