- Researchers discovered a new phishing -campaign that abused dynamics 365 customer voice
- Microsoft’s tools have more than 500,000 users
- Many of the users are Fortune 500 -Companies
Researchers from Check Point have discovered a new phishing campaign that abuses a legitimate Microsoft product in an attempt to steal people’s login -deadlimation information.
In a new blog post published earlier in May, the researchers said the named attackers would send phishing -e emails from previously compromised accounts and would include Fake Dynamics 365 Customer Voice Links.
Dynamics 365 Customer Voice is a tool designed to help companies collect, analyze and shop on customer feedback in real time. It includes things such as voice recordings, monitoring of customer reviews, studies and the like. According to the checkpoint, the pacifier landscape is huge and quite potent as it is used by at least 500,000 organizations, including 97% of the Fortune 500 companies.
Thousands of goals
The topics for E emails are financially focused, the researchers added. Subject lines are usually about settlement declarations, Alta, EFT payment information or closure of information. In an example, the researchers added a link leading to the malicious destination page right next to a legitimate link. The malicious link first brings the victims to a CAPTCHA page, after which they are redirected to a credentials page.
Check Point also said that attackers are also able to catch MFA codes, even if they did not explain exactly how it is done.
So far, attackers managed to send more than 3,000 E emails and target at least one million different inboxes. These belong to more than 350 organizations, the researcher said, suggesting that this has already turned into a big, dangerous campaign.
Victims are mostly “well-established societal improvement groups, colleges and universities, news sites, a prominent health information group and organizations that promote art and culture.”
Unfortunately, it is impossible to tell how many login information the miscreans managed to get so far. Apparently, Microsoft already blocked some of the phishing pages.
