- Security researchers who warn of new phishing -campaign
- This abuses Microsoft’s Authorization System
- The goal is to steal sensitive data and login credentials
Cybercriminals mimic Microsoft’s Active Directory Federation Services (ADFS) to steal people’s passwords, log in to their accounts and get hold of sensitive information that exists there, experts have warned.
A new report from cybersecurity scientists abnormal security noted how the attack starts with a phishing email that mimics the target company’s IT team and claims that the system has been upgraded and that all users need to authorize.
Of course, the E -mail also comes with a clickable button that takes the victim to a phishing place that looks identical with their organization’s Real ADFs -Login page.
Redirect of the victims
Microsoft’s Active Directory Federation Services (AD FS) is a single sign -on (SSO) solution that gives users access to multiple applications using a single set of credentials. It extends Active Directory (A AD) to provide federal identity management, enabling trouble -free and secure approval across different organizations, cloud services and applications.
This page asks for login -credentials and MFA codes.
“Phishing templates also include forms designed to capture the specific other factor required to authenticate the target’s account, based on the organization’s configured MFA settings,” Abnormal said in paper.
“Abnormal observed templates targeted at several commonly used MFA mechanisms, including Microsoft Authenticator, Duo Security and SMS verification.”
When the victim enters in their login information, the destination page redirects them to the legitimate login page to keep Ruse going. In the background, however, the striker already logs in, steals sensitive data, creates new E -mail filter rules and tries to move laterally through the target network.
Abnormal added that the campaign is mostly aimed at organizations in education, healthcare and the public sector. So far, about 150 organizations have been targeted, it added. The goal of the campaign does not appear to be espionage. Instead, it seems to be financially motivated.
