Vane3alga

Business
Focused
Technology

Using a fake internal memo from HR, per-user custom-named email attachments, SharePoint Online, and a realistic-looking HR form, this phishing attack has all the ingredients to trick your users.

it360 feb 01

This far into the pandemic, there are groups of users within your organization begging to come back to the office, as well as those that never want to set foot in the office again. This emotional attachment to either sentiment is the basis for this newest scam, documented by security researchers at Abnormal Security.

The scam appears to come from internal HR, informing users of dates that the offices are expected to reopen and when employees should return to the office to work. Each contains an HTML attachment with the victim’s name on it (see below).

it360 feb 02

Unlike most html attachments, the link doesn’t take the user to a malicious webpage; instead it takes them to a SharePoint Online document that appears to be an HR document the user is required to acknowledge. This use of a legitimate Office 365 SharePoint site helps these attacks bypass security and find their way to the user’s Inbox.

The most dumbfounding part of this attack is how the user is tricked out of their credentials. At the end of the HR form, they are simply asked for their email address (which is presumed to be their username) and then asked to enter in their password as a means to establish identity as part of agreeing to the presented HR policies. Anyone who understands when and where passwords would be used can easily see this isn’t one of those times.

The scam is a good one – it uses evasive techniques to ensure delivery, establishes legitimacy and urgency, and quickly seeks to reach its malicious goal. Users that have undergone Security Awareness Training should be able to spot this as being a scam, keeping their credentials – and your organization – secure.


SOURCE: KnowBe4.com

Success Stories

President, Manufacturing Company

We are high speed and wireless with computer systems for everything we do. I do not worry at all because it has not been an issue since IT360 became a part of our company.

President, Manufacturing Company

Recent
Technology News

IT 360 News - Successful Automation, Seamless Invoice Processing
Successful Automation, Seamless Invoice Processing

In the fast-paced world of managed IT services, efficiency and accuracy in financial operations are crucial for maintaining client trust and operational effectiveness. IT360 is proud to announce the successful completion of a critical project aimed at streamlining our invoice processing system, addressing a challenge that had been impacting our financial workflows. Problem Overview: IT360 […]

Read more
IT 360 News - Elevate Your Communication with IT360’s Advanced Phone Solutions
Elevate Your Communication with IT360’s Advanced Phone Solutions

Unleash the Power of Seamless Connectivity Welcome to IT360, where cutting-edge technology meets unparalleled communication efficiency. Our advanced phone systems are expertly designed to cater to the diverse needs of modern businesses, ensuring you stay connected in today’s fast-paced world. Transform your business’s communication infrastructure into a robust, adaptable, and scalable network with our solutions, […]

Read more