- Criminals use stolen E -Mail addresses to distribute malicious OAuth -Apps
- These apps steal sensitive data and redirect people to phishing -sides
- The pages steal the login -AdIrimation information and provide malware
Hacker’s forgery of popular cloud and productivity apps to steal People’s Microsoft 365 Login Legitimation Information and deliver malware, experts have warned.
CyberSecurity -Scientists Proofpoint detailed their findings in an X -thread, which revealed unidentified cyber criminals used compromised Office 365 accounts and E -mail addresses belonging to charities or small businesses to launch the attacks.
It is unclear what the content of E emails is, but apparently the goal is to get victims to install malicious Microsoft OAuth apps that pretend to be Adobe Drive, Adobe Drive X, Adobe Acrobat and Docusign.
“Very targeted” attack
Those who install these apps are asked to give specific permissions: ‘Profile’, ‘E -Mail’ and ‘OpenID’. Only these are not so destructive as they only give access to the user’s name, user IID, profile picture, username and the primary E -mail address (no access, only information about the account). The ‘OpenID’ permit also allows attackers to confirm the victim’s identity and retrieve their Microsoft account information.
Although these are not enough to steal data or install malware, they can be used in more personalized phishing attacks, the researchers said. The campaign itself was “very targeted,” said proofpoint and went for organizations in various industries throughout the United States and Europe, including government, healthcare, supply chain and retail.
After granting these permissions redirects apps the victims of phishing -landing pages, Login collects credentials and distributes malware. Proofpoint could not confirm the load of malware that was distributed in this way, but emphasized that attackers used Clickfix Social Engineering attacks.
Today, clickfix has grown quite popular. It starts with a browser popup that informs the victim that they cannot see the content of the website unless they update their browser (or something similar). The popup shares step on how to “solve” the problem, and fool the victims to download malware instead.
Via Bleeping computer
